(252) 565-1235

Carolina IT Group

Call Us (252) 565-1235 Request Support Contact Us

Embedded Sound Waves Could Damage Your Computer

by

It seems like a new attack vector emerges on a weekly basis, and this week is no exception.  The latest threat:  Emails containing specialized audio files whose acoustic vibrations can damage your computer’s hard drive. This is possibly damaging to the point of causing system failure, data corruption, and making it impossible to successfully reboot your machine.

As the researchers point out, “Intentional acoustic interference causes unusual errors in the mechanics of magnetic hard disk drives in desktop and laptop computers, leading to damage to integrity and availability in both hardware and software such as file system corruption and operating system reboots.  An adversary without any special-purpose equipment can co-opt built-in speakers or nearby emitters to cause persistent errors.”

It should be noted that as scary as this type of attack sounds, in practice, it is of limited value.  An increasing percentage of laptops and desktop PCs sold today come with SSDs for storage, which are not vulnerable to this type of attack.

In addition to that, not just “any” sound will do.  For the attack to be successful, the acoustic vibrations have to be strong enough to do real harm, and quiet enough that the attack is difficult to detect, lest it be aborted immediately.  The combination of those two factors make it unlikely that this one will gain widespread attention from the hacking community.  Nonetheless, it pays to be both mindful and vigilant, especially if you have an older PC or work in an office with older equipment.

The research team who discovered the new attack vector have created a new sensor fusion model that could be delivered through a firmware update.  Once updated, it would prevent unnecessary head parking in the hard drive, thus limiting the potential damage the attack could cause.  So far, there has been no word that PC manufacturers are considering making the necessary changes to their firmware.  Time will tell.

More Bad News From The Equifax Breach

by

The news just keeps getting worse for Equifax.  The company has already had to revise their estimates of how many people were impacted by last year’s breach more than once, and now, they’re having to revise their estimate yet again.  This latest revision comes after company officials had to testify before Congress, which has been formally investigating the matter.

Prior to the release of Equifax’s latest “statement of record,” here’s a snapshot of how bad the data breach was:

5 million consumers had their Social Security numbers compromised

99 million consumers had address information exposed

3 million consumers had gender information exposed

3 million consumers had their phone numbers exposed

209,000 consumers had their credit card numbers exposed

97,500 consumers had their Tax Identification numbers exposed

Now, in addition to all of that, the company is adding the following:

6 million consumers had their driver’s license numbers exposed

12,000 had their Social Security and Taxpayer ID cards exposed

3200 consumers had their passports exposed

An additional 3000 had other documents, such as military and state ID’s compromised

As bad as it looks that the company has to keep revising their estimates upward, there’s a logical reason for it.  The data that was stolen didn’t come from a single database.  On top of that, the databases themselves all had highly variable structures, which has made it exceedingly difficult for forensic analysts to accurately assess the extent of the damage.  All that to say, since the process is still ongoing, we may see yet another upward revision of the scope and scale of the breach.

Of course, the company is doing what most companies do in cases like these:  They’re offering a year’s worth of free credit monitoring to impacted customers.  The ironic part of their offer though, is the fact that Equifax is offering their own credit monitoring service free for a year, which converts to a paid monitoring service after the year is up.  As Congressional officials rightly pointed out, this means that the company is essentially profiting off of its own breach, which is disturbing to say the least.

Contact Info

740 Greenville Blvd. SE., Ste. 400-374
Greenville, NC 27858

Phone: (252) 565-1235