(252) 565-1235

Carolina IT Group

Call Us (252) 565-1235 Request Support Contact Us

Americans Want Local Governments To Spend More On Cyber Security

by

While a significant percentage of Americans are suspicious of government spending beyond the essentials, there’s at least one notable exception, according to a recent survey conducted by SecurityFirst.

A majority (74 percent) of Americans want their local governments to spend more money on cybersecurity.

Here are a few of the highlights from the survey:

64 percent believe that a ransomware attack on local government installations could have serious, long-term impacts

Only 33 percent of respondents believe that their local governments are capable of keeping their data safe in the event of an attack

60 percent believe that a cyberattack could jeopardize essential services, and 77 percent fear that fallout from such an attack could hinder first responders

In terms of the biggest concerns of the citizenry, the data broke out as follows:

74 percent cited potential dangers to local utilities

68 percent cited potential dangers to our court system

68 percent cited potential dangers to local schools

Not long ago, the city of Atlanta suffered just such an attack, which cost them millions of dollars and erased several years’ worth of critical data.  The city is still working to recover from the incident.  It underscores the fact that the concerns brought to light by the survey are all too real, that citizens are right to worry, and they demand more from their local governments.

Unfortunately, in an age where government spending of any kind almost reflexively comes under intense scrutiny and debate, it remains to be seen whether this and similar surveys will provide any traction to the idea of greater government spending on cybersecurity.

If it does not, then we can expect to see more incidents like the unfortunate attack on Atlanta, with similar consequences.  If the past is any indication, the survey will generate a few conversations, but not much in the way of action.  Sadly, it will probably take a major attack that costs lives before we start getting serious about protecting local governments and critical infrastructure.  Here’s hoping it doesn’t come to that.

Bug In Facebook May Have Unblocked People You Blocked

by

Facebook recently announced a site bug that impacted the privacy settings of more than 800,000 of its users.  If you’re one of the unfortunate souls who has been affected, then people you had formerly blocked may have become unblocked, and can now see your posts.

For many people, that’s not a huge deal. In some cases, say for example, if you blocked your ex-girlfriend, boyfriend, or wife and were impacted, they may be able to see things you don’t want them to.

Facebook’s official statement in response to the matter provided additional details and said that 83 percent of the people who were impacted only had one person on their blocked list temporarily unblocked, and that the situation had been remedied.

Of significance, the bug did not allow unblocked users to see content shared by friends of those who had blocked them, and it did not reinstate a “severed” friendship on the system.  In some cases, however, someone who had been blocked may have been able to establish (or attempt to establish) a Facebook Messenger communication with the person who had blocked them.

The bug was active between May 29th and June 5th, and was caused when a small amount of data governing “associations” between users was deleted.  When the data was restored, the issue went away on its own.

The number of impacted users may sound grim, but given the legions of people who use Facebook, it’s actually a drop in the bucket.  Even so, Facebook’s response was immediate, decisive, and the company took actions to reassure its user base that the issue had been resolved and they would take steps to see that it did not happen again.

Nice words, but given the intense scrutiny Facebook has been under in recent months, blunders like this one only underscore that the company still has a lot of work to do where privacy is concerned.

LTE Networks May Be Vulnerable To Hacking

by

Researchers from Ruhr-Universität Bochum and New York University in Abu Dhabi have discovered serious security flaws in 4G LTE networks that allow hackers to spy on, listen in on, intercept, and disrupt phone calls and text messages.

Given that billions of people rely on 4G LTE networks for cellphone communications, it’s a serious issue, and there are no easy fixes. So, don’t expect these flaws to be patched out of existence any time soon.  Worse still, the planned 5G networks currently in development may well suffer from the same (or similar) flaws.

Based on their research, the team was able to develop a trio of new attacks that specifically target weaknesses in the 4G LTE architecture.

One of these, dubbed “aLTEr” is a DNS spoofing attack that allows a hacker to become the “man in the middle,” intercepting communications, and gives them the ability to spoof alerts, texts, and other messages.

All three of the attacks developed by the team take advantage of weaknesses found in “Layer Two” of the LTE network.

This is the data layer that rests atop the physical channel.  Its function is to maintain wireless communication between users and the network itself, and has an organizational function that (among other things) manages how users access various resources on the network, helping to protect data via encryption and to correct errors in transmission.  Obviously, a hack that can exploit this layer could be devastating indeed.

If there’s a silver lining, it lies in the fact that these three attacks are exotic. It would be difficult for a casual or even a fairly determined hacker to execute to any real effect.  Unfortunately, it would be a much easier task for a state-sponsored group to pull off, and that’s the big fear here.

Hopefully, since 5G networks are still in the planning stages, something can be done before they’re rolled out to limit the effectiveness, or perhaps even negate these new types of attacks, but that remains to be seen.

Mobile Users Gain Privacy Protection In Supreme Court Ruling

by

There’s some good news from a recent Supreme Court ruling where privacy is concerned, but take it with a grain of salt.

In a recent 5-4 decision, the Supreme Court ruled that law enforcement agencies must obtain a warrant before they can get access to data collected and stored on mobile devices.  Of special significance, the court rejected the “third party rule,” which dates back to the 1970’s and asserts that any data collected by third-parties is automatically devoid of Constitutional protection.

The ruling is undeniably good news, and privacy advocates who have been watching the issue closely hail the decision as a victory for individual privacy. However, it should be noted that in the overwhelming majority of cases, “probable cause” is sufficient for most judges to grant a search warrant to law enforcement officials.

The reality is that probable cause is one of those “squishy” words that can mean wildly different things to different people.  While it serves as a speed bump to accessing data on mobile devices, it’s a relatively modest one that’s unlikely to prevent many instances of law enforcement getting the information they need during the course of their investigations.

All that to say, it’s a good first step, but this ruling alone isn’t enough.  So far, no national government anywhere in the world has been able to craft a set of sensible policies that adequately protect the privacy of individuals on the web.  Corporations collect oceans of data on the consuming public, and increasingly, that data is packaged, resold and used for a variety of purposes.

While most of those purposes are fairly harmless and aimed more at marketing than anything else, other purposes border on or are abuses of the public’s trust.  There are no easy fixes here, but kudos to the Supreme Court for taking an important first step.

New SSD Drive Can Hold 8TB of Storage

by

Good news for the business world in general, and the owners of data centers, in particular.

Mass storage is about to get vastly more efficient thanks to Samsung’s recently launched solid state drive, which manages to pack an impressive 8TB of storage into a delightfully small footprint, measuring just 11cm x 3.05cm.

Not only do the new drives deliver twice the storage capacity of the SSDs used in high-end servers and slim line laptops, but it also has an impressive read speed of 3100 MB/s, and write speeds of 2000 MB/s.  The read speed of the new drive is five times faster than the speeds you typically get from SATA SSDs, and the write speeds are three times faster.

When hyper-scaled, that means that enterprise server system could perform more than a million IOPS in a 2U rack space, and that translates into a significant ROI for large-scale data centers.

It gets even better.  Samsung is planning to release a 512 gigabit version of its 3-bit V-NAND SSD later this year, which will allow significant improvements in processing speeds for big data applications.

What we’re talking about here, ultimately, is storage and processing density.  The new SSD is built with 16 512GB NAND package, stacked in sixteen layers of 256 gigabit 3-bit V-NAND chips that were specifically engineered with massive SSDs in mind.

This allows data centers to triple total system density in the same footprint, and allows for a mind-boggling 576 terabytes of storage in 2U rack servers.

This is paradigm shifting and will make cloud-based service providers even more attractive. The most successful of these already have hyper-scale data centers in place, already have a wealth of experience when it comes to handling Very Large Data sets and experience dealing with applications designed to sift through those mountains of data.  Enterprise users, rejoice!

Vulnerability In Mac OS Went Unnoticed For Years

by

Researchers at Okta Security have stumbled across something big.  Recently, they discovered a flaw in Apple’s OS that would have allowed hackers to completely undermine Apple’s code signing process.

While at first glance that doesn’t sound so bad, the implications are terrifying.  In a nutshell, code signing uses cryptographic “signatures” to verify and validate code.  If code bears the digital signature, it is considered trusted.  If it’s trusted, then it’s given an automatic free pass, straight into the heart of any system.

Unfortunately, this flaw in Apple’s code signing process dates back more than a decade. It was only recently discovered, and purely by chance at that.

An extensive forensic analysis has turned up no evidence suggesting that this exploit was ever used for nefarious purposes, which is the one silver lining in all of this.

Upon discovering the flaw, Okta personnel reached out to Apple and other vendors who could have been impacted by the flaw, including tech giants like Google, Facebook and also smaller players like VirusTotal, Objective Development, Yelp, and Carbon Black.

Apple moved swiftly and has since fixed the issue, so this one can be considered a bullet dodged.

Josh Pitts, an Okta engineer, sums the issue up:

“Different types of tools and products use code signing to implement actionable security; this includes whitelisting, antivirus, incident response and threat hunting products.  To undermine a code signing implementation for a major OS would break a core security construct that many depend on for day to day security operations.”

A completely fair assessment.  Thankfully (at least in this particular case), although the issue was hiding in plain sight, it does not appear to have been exploited before being fixed.  We won’t always be so lucky.

Study Shows People Prefer Alternatives Over Passwords

by

File this one away under “confirming things we already knew.”  A recent study conducted jointly by Blink and Trusona confirmed that people just don’t like passwords very much.

Their study tracked the login behavior of 148 participants over a three-week period.  Without knowing the true purpose of the study, participants were asked to log into a gift idea generation website at least three times a week.

They were given the option of a “classic” (password-based) login, or an “easy” login option, which utilized alternative forms of authentication.

The results should surprise no one, but here are some of the statistics collected during the course of the experiment:

84 percent of participants utilized the easy login at least once

47 percent of participants utilized the classic login at least once

Those who used the easy login had successful logins 78 percent of the time

Those who used the classic login had successful logins 56 percent of the time

Per Robert Capps, a VP for NuData Security,

“This report shows that consumers are ready to move beyond passwords and usernames to more secure authentication methodologies.  Using a multilayered authentication framework that combined behavioral analytics with biometrics allows companies to verify users accurately without adding unnecessary friction and detect any unauthorized activity before it enters the environment.

Multilayered solutions that include these technologies analyze hundreds of data points throughout a session and create an evolving profile of a user across the session.  Passive biometrics and behavioral analytics are technologies that can provide this level of monitoring without adding friction to legitimate users, thus creating more convenient experiences for users.”

Clearly, users don’t like passwords.  Unfortunately, there’s currently no technology on the market capable of the feats Mr. Capps describes.  There are several promising models and products in varying stages of development, but sadly we’re still a ways off from realizing a password-free, hyper-secure login paradigm.  That day is no doubt coming though, and not a moment too soon.

Contact Info

740 Greenville Blvd. SE., Ste. 400-374
Greenville, NC 27858

Phone: (252) 565-1235