Security – Page 18

A Million Imgur Users Affected By Breach

December 12, 2017 by Joseph Martin

Do you use the image hosting service, Imgur? If you do, there’s a slight chance that you’ll be prompted to change your password the next time you log on. That’s because the company’s servers were breached in 2014, and the hackers made off with 1.7 million usernames and passwords, which represents just a tiny fraction of the company’s 150 million users.

Although the breach happened a few years ago, the company only found out about it on Thanksgiving Day of this year. Their response was immediate and decisive. The company called people in over the holiday and notified their impacted users just 25 hours and 10 minutes after discovering the details of the incident.

Contrast that to Uber’s handling of their most recent hack. They kept their impacted users in the dark for more than a year, and worse, paid the hackers $100,000 to keep the incident quiet. It’s easy to see why security professionals around the world have lauded Imgur for their handling of the hack.

Three key things to note in relation to the breach:

Not much information was stolen during the hack because Imgur doesn’t ask its users for much in the way of personal information in the first place. However, if you use your Imgur password on other systems, you could be at additional risk.

At the time of the breach, Imgur was using SHA-256 encryption, which is fairly robust and impractical for most hackers to crack due to the amount of computational power required.

In 2015, the company switched to an even more secure algorithm, Bcrypt, so if the company is breached again in the future, it’ll be even harder for the hackers to glean anything useful from any data stolen.

All that to say, if you’re looking for a benchmark to compare yourself to if you’re ever hacked, Imgur’s example would be an excellent one to follow.

Joseph Martin

President & CEO
I hope you enjoyed this article. My mission is to take your stress away from dealing with IT problems. Call (252) 565-1235 or send me a message at our contact us page if you have a question, comment or want help.

Apple Devices Can Get Viruses

December 11, 2017 by Joseph Martin

Are you under the impression Apple devices are exempt from viruses and hacking?

A great deal of Apple users consider Apple systems safer to use than Windows because of the “built-in” security Apple programs into their devices. But Windows operating systems also come with similar existing security to prevent hackers and viruses. So why is there a difference in virus vulnerability?

So here’s the deal:
In their advertising, Apple markets its systems as not needing third-party antivirus software. In reality this “built in” virus protection is identical to what’s inside a Windows PC. It possesses the same flaws and loop-holes as any other operating device.
So, if Apple and Windows both have the vulnerability to be hacked, why is Windows suffering the most?

What separates the two operating systems’ security is the basic fact that hackers are still more familiar with Windows computers and their security loopholes.
Additionally, Windows is easier to hack and can have a potentially bigger pay-off for hackers. As Apple operating systems become more popular, hackers will familiarize themselves with the OS platform.

This will in turn will lead to more viruses made specifically more Apple.

So what can you do to protect your computer?
While there may be fewer Apple systems infected overall, there is missing data on the exact number of Apple systems that contain viruses, such as malware.

Since most Apple users do not install security software that scans and reports malware, many viruses stay under the radar.

Unlike Apple users, most Windows users download security software which results in more accurate reporting.

Even if Apple is safer from than Windows without third-party security software, there is still a risk of “catching” a virus through programs such as Java, Flash or Adobe.

Our advice: Don’t rely on Apple’s built-in security! Invest in another sources of anti-virus protection to keep your computer safe.

Joseph Martin

Breach Of Health Data Gets California Company $2M Fine

December 10, 2017 by Joseph Martin

Cottage Health System, a company that operates five hospitals in the Santa Barbara area of California, is the latest firm to have been hit with a hefty fine for losing control of PHI and PII for patients that it serves.

In this case, more than 55,000 patients were impacted between 2013 and 2015.

Cottage Health discovered the breach late in 2013. The company received a voicemail message informing company officers that there was a large file containing PHI of an unspecified number of its patients available online, without encryption or password protection that could prevent unauthorized access. In 2015, the company suffered a second, much smaller breach that impacted 4,596 of its patients.

As a result of the investigation that followed, the California Attorney General determined that the Cottage Health System had violated California’s Confidentiality of Medical Information Act, as well as several federal HIPAA regulations.

Under the terms of the agreement, in addition to a $2 million fine, the company has been required to upgrade its data security practices, including:

• Training employees on the collection, storage and proper use of PHI and PII

• Maintaining a reasonable set of policies and protocols surrounding incident tracking reports, risk assessment, data retention, internal audits and incident management plans, subject to external review

• Encrypting all PHI and PII in transit

• Assessing all hardware and software used in Cottage Health’s network for potential vulnerabilities, and upgrading as appropriate

• And conducting periodic testing to identify and address additional vulnerabilities.

This most recent incident serves as a painful reminder to any company involved in the handling of PHI and PII. According to Elizabeth Hodge, a health care attorney of the law firm Akerman, LLP:

“Even if the Office for Civil Rights slows down its enforcement activities going forward, covered entities and business associates should still anticipate enforcement activity by state attorney’s general enforcing their respective state laws.”

Joseph Martin

Uber Paid To Hide Massive Data Breach From Public

December 9, 2017 by Joseph Martin

It has recently come to light that the company was hacked in 2016 in a massive breach that exposed the personal information of more than 57 million Uber users and drivers. A wide range of data was stolen. Where users were concerned, names, email addresses, and phone numbers were compromised.

As bad as that is, the problem was even worse for more than 600,000 of the company’s drivers who had their driver’s license numbers hacked, too.

Standard protocol is that when a breach like this occurs, the company will engage law enforcement officials as appropriate, hire a third-party security firm to help with the forensic investigation and notify their consumers.

Unfortunately, that’s not the path Uber chose to take. Instead, they paid the hackers $100,000 in exchange for keeping quiet about the hack and deleting the stolen data.

The company kept the incident under wraps for more than a year, but eventually, word of the attack leaked out, and the fallout has been catastrophic. Uber’s CEO Dara Khosrowshahi has asked for the resignation of the company’s Chief Security Officer, Joe Sullivan, and one of his deputies, Craig Clark, both of whom worked to keep the attack quiet.

In a formal statement, Khosrowshahi had this to say:

“None of this should have happened, and I will not make excuses for it. While I cannot erase the past, I can commit on behalf of every Uber employee that we will learn from our mistakes. We are changing the way we do business, putting integrity at the core of every decision we make and working hard to earn the trust of our customers.”

As is common in the aftermath of events like these, Uber is offering its impacted customers a free year’s worth of credit monitoring services and will likely force password changes for its app users. More than a year too late, but it’s something.

File this away under how not to handle a data breach.

Joseph Martin

Ransomware Is Spreading Through Macros In Word

December 8, 2017 by Joseph Martin

Security researcher Jaromir Jorejsi of Trend Micro has discovered a disturbing new strain of ransomware named qkG that spreads by way of macros inside MS Word.

The ransomware strain targets only Office documents, encrypting them and infecting the Word default document in order to propagate to newly created documents opened via the Office suite on the infected computer.

This new threat is unusual in the world of ransomware because it abides by a completely different and much more tightly targeted set of operating principles than any other form of ransomware found in the wild today. It’s also a bit of a throwback. The use of macros to spread worms is still fairly commonplace on older machines running out-of-date or pirated copies of Office, but it hasn’t really been in fashion in the mainstream hacking community for quite some time.

An analysis of the code reveals it to be a work in progress. The researchers were quick to point out the ransomware has not found any actual victims to date, and that several different variants and strains of the code were found in different documents, each with a different and slightly more robust feature set.

Based on evidence Horejsi found in the qkG samples he had the opportunity to analyze, the author of this new strain is apparently based somewhere in Vietnam, and goes by the alias “TNA-MHT-TT2.”

The malware is notable for its rather innovative use of malicious macros. Horejsi warns that these techniques will undoubtedly be picked up by other hackers, refined and used more broadly in the months ahead.

That’s likely to pose a special challenge for your IT security team, who have probably fallen out of the habit of watching for such threats, given that they declined in popularity some time ago. It seems, however, that what’s old has been made new again, so alert the troops to be ready.

Joseph Martin

Known WordPress Malware Is Back For Second Round

December 7, 2017 by Joseph Martin

This past summer, an Italian security researcher named Manuel D’Orso discovered a nasty malware attack aimed at WordPress sites.

Dubbed “Wp-Ved,” after the name of the .php file bearing the malicious payload, the attack was relatively small in its scope and scale, with a few scattered attacks starting in the summer and continuing in sporadic fashion to this very day.

Apparently, the hackers who own the code learned what they needed to, and recently an updated variant of the malware has been spotted in the wild.

The malware is not subtle. It doesn’t try to hide what it’s doing in the least. It simply injects malicious code into legitimate files, focusing on old WordPress default themes such as “Twentyfifteen” and “Twentysixteen.”

Once the code is in place, it works quickly to create a new Admin user with the name “100010010,” which gives the hackers a backdoor they can use to launch other scripted attacks at their discretion.

Again, owing to the completely un-subtle nature of the code, any user who is running any sort of web application firewall (WAF) would be completely immune to this type of attack, as the WAF would have spotted it immediately and shut it down before it could do any damage. Sadly, a significant percentage of webmasters running WordPress sites don’t take advantage of this sort of protection.

Although this isn’t a large-scale, coordinated attack, given the sheer number of WordPress sites on the web, it’s something to be mindful of. As to the damage, the hackers could cause if you are infected, unfortunately, the sky’s the limit. Once they’ve got an Admin-level backdoor to work with, there’s not much they couldn’t do, so if you run a WordPress-based site, it’s worth your time to check to see if you’ve been infected. If you have, you’re sitting on a ticking time bomb.

As to how you can protect yourself, the first step is, of course, to delete the files containing the malicious code.

Once that’s done, disable and delete the rogue Admin account, and if one is available, begin making use of a web application firewall so that you can avoid any problems with Wp-Ved in the future.

The WordPress community is, on the whole, quite good at rooting out malware designed to work on the platform. However, this is certainly not the first such campaign hackers have gotten past the active community’s defenses, nor will it be the last.

Just recently, for example, security researchers found vulnerabilities in two of the platform’s most popular plugins, Yoast SEO and Formidable Forms.

In the case of the Yoast security flaw, it has been patched as of version 5.8 of the plugin, so if you use Yoast, be sure you’re using the most up-to-date version.

The bug in the Formidable Forms plugin was patched in version 2.05.02 and higher, so again, if you’re using this plugin on your website, be sure you’ve got the latest and greatest installed.

Joseph Martin

Issue With Android Could Let Someone Record Screen And Audio

December 6, 2017 by Joseph Martin

Do you have an Android phone? Is it running either Lolipop, Marshmallow or Nougat? Those three account for slightly more than 75 percent of the Android phones in service today, so odds are excellent that you do. If so, you should be aware of a nasty vulnerability that could allow a hacker to perform at-will screen captures and audio recording without your knowledge.

The issue resides within Android’s MediaProjection service, which has been a part of the OS since its earliest days. The reason that it has only recently become an issue, though, is that prior to the release of Android Lolipop (version 5.0), third-party apps couldn’t make use of it. It required both root-level access and the app in question had to be signed with the device’s release keys, which meant that only system-level apps deployed by Android OEMs could utilize MediaProjection.

That changed with the release of Lolipop, which opened the service up so that anyone could use it. Unfortunately, when Google relaxed access to the service, they didn’t put it behind a permission that apps could require from users. All a third-party developer needs to do to access MediaProjection is to make an “intent call” that would show a System UI popup, warning users that an app wanted to capture the screen and/or system audio.

Here’s the problem, though. Security researchers discovered that an attacker could detect when the system popup would appear, and knowing that piece of information, they could trigger some other message to appear on top of it, effectively blinding the phone’s owner to the fact that screen captures and audio recordings were in process.

Since the discovery of the security flaw, Google has released a patch that addresses it. Unfortunately, the patch only applies to Android Oreo (8.0). Older phones are still vulnerable.

If there’s one saving grace, it is the fact that the attack is not completely stealthy, and observant users will note the screencast icon in the phone’s notification bar. It’s far from perfect protection, but it’s something, so be aware if you’ve got an older Android phone.

Joseph Martin

Google Can Still Track You With Location Services Disabled

December 5, 2017 by Joseph Martin

Google recently found itself in a bit of hot water after an investigation by Quartz revealed that the company was intrusively collecting location data on literally every Android device in use today. That’s billions of devices all over the globe.

There are many instances when there’s an expectation that location data can and will be tracked. In fact, one of the most commonly used features of smartphones in general (GPS and directions) demands it. After all, Google Maps can’t tell you how to get where you’re going if it doesn’t know where you are, to begin with, so that’s all fine and good.

The problem, as revealed by the recent investigation, is that for all of 2017, Google was collecting location data on every Android device. This was happening even if the user took a series of frankly heroic measures in an effort to prevent it, including turning off location services, not allowing any apps to track their location and even pulling their SIM card from the phone.

The practice, as Quartz rightly pointed out, goes far beyond any reasonable expectation of consumer privacy and is wildly intrusive.

When Quartz made inquiries of Google regarding the matter, part of the official company response, sent via email, was as follows:

“In January of this year, we began looking into using Cell ID codes as an additional signal to further improve the speed and performance of message delivers. However, we never incorporated Cell ID into our network sync system, so that the data was immediately discarded, and we updated it to no longer request Cell ID.”

In recent years, all the major tech companies have come under fire for the vast amounts of data they collect on consumers of their products. Although Google made it clear that they were formally ending the practice, the current climate makes their intrusive data collection effort (which, again, went completely undetected for the better part of a year) even more disturbing, especially given the lengths the company has gone to in an effort to position themselves as champions of user privacy.

Joseph Martin

More Bad News For OnePlus Phone Users

December 2, 2017 by Joseph Martin

OnePlus phones have been getting plenty of bad press lately, thanks to malicious apps found to be factory-installed on a percentage of the devices, along with some intrusive data collection features the manufacturer has installed. As it turns out, though, the story gets worse.

Recently, a security researcher going by the alias “Elliot Alderson” discovered a factory-installed application called “Engineering Mode” that can perform a series of intrusive hardware diagnostic routines and can even be used to root the device. What’s worse is that security flaws in the app make it easy for hackers to exploit.

Alderson believes that the likeliest scenario for the existence of the Engineering Mode application is that it was a diagnostic app installed and used at the factory to test OnePlus phones prior to shipment. Somehow, the app was never uninstalled after the initial testing was completed, exposing OnePlus users to the extreme danger of losing control over their devices and any data stored on them.

According to Alderson, all a hacker would need is physical access to the phone. Once he has it in hand, one simple command is all it takes to root the phone. Other researchers have independently verified Alderson’s findings. Since he first published them, the company has admitted their mistake and promised to remove Engineering Mode from all OnePlus phones in a future update, although no ETA was given for when that might occur.

If you currently own and use a OnePlus phone, be aware of this and use with caution. Keep on the lookout for the update from the manufacturer which will remove the “feature” for you, but if you’d rather not wait, you can go into the phone’s settings and manually remove it.

Physical security of smart devices has always been vitally important, but in the case of the OnePlus, that’s doubly true. Keep it close!

Joseph Martin

Malware Infections Grow 4X In Just One Quarter

December 1, 2017 by Joseph Martin

The world’s hackers have been busy according to the latest report by Comodo security, which tracks the total number of threats around the globe, quarter by quarter. The latest statistics are alarming, showing a massive jump in the total number of malware infections reported in the third quarter of 2017. Reports show nearly 400 million infections.

What’s worse is that the infections have spread to literally every corner of the globe. No nation is completely safe.

Digging more deeply into the statistics offered by Comodo, we find that the top five countries for malware infections this quarter were:

Russia

The United States

Poland

The United Kingdom

And Germany

These five nations combined accounted for fully 80 percent of the total number of infections reported.

Breaking the infections down by type, we find the following as the top 5:

Trojans (13.7 million)

Viruses (5.4 million)

Worms (2.8 million)

Backdoors (553,000)

And Packed Malware (284,000)

Diving even more deeply into the statistics yields more good information, including the fact that poorer nations tend to be afflicted more often by viruses and worms as these nations tend to use the older, unpatched or unlicensed software. These types of infections tend to run rampant in Southeast Asia, Southeastern Europe, Africa and South America.

The report also details that the number of large-scale email phishing attacks is on the rise, due in no small part to the recent popularity of Locky and other strains of ransomware, with the largest phishing attack having been conducted from August to September 2017. According to the report:

“This attack was unique in its combination of sophistication and size, backed by a botnet spread across more than 11,000 IP addresses in 133 countries in just the first stage of the attack. Also, the malware was designed to avoid detection by sandboxing and artificial intelligence technologies common in many endpoint protection systems.”

All in all, it’s a fascinating, though disturbing read, and points to the rapidly increasing sophistication of the world’s hackers that will no doubt continue to spell trouble for security professionals around the globe.

Joseph Martin

Apple Devices Can Get Viruses

Breach Of Health Data Gets California Company $2M Fine

Uber Paid To Hide Massive Data Breach From Public

Ransomware Is Spreading Through Macros In Word

Known WordPress Malware Is Back For Second Round

Issue With Android Could Let Someone Record Screen And Audio

Google Can Still Track You With Location Services Disabled

More Bad News For OnePlus Phone Users

Malware Infections Grow 4X In Just One Quarter

Contact Info

Navigation