(252) 565-1235

Carolina IT Group

Call Us (252) 565-1235 Request Support Contact Us

Bug In Facebook May Have Unblocked People You Blocked

by

Facebook recently announced a site bug that impacted the privacy settings of more than 800,000 of its users.  If you’re one of the unfortunate souls who has been affected, then people you had formerly blocked may have become unblocked, and can now see your posts.

For many people, that’s not a huge deal. In some cases, say for example, if you blocked your ex-girlfriend, boyfriend, or wife and were impacted, they may be able to see things you don’t want them to.

Facebook’s official statement in response to the matter provided additional details and said that 83 percent of the people who were impacted only had one person on their blocked list temporarily unblocked, and that the situation had been remedied.

Of significance, the bug did not allow unblocked users to see content shared by friends of those who had blocked them, and it did not reinstate a “severed” friendship on the system.  In some cases, however, someone who had been blocked may have been able to establish (or attempt to establish) a Facebook Messenger communication with the person who had blocked them.

The bug was active between May 29th and June 5th, and was caused when a small amount of data governing “associations” between users was deleted.  When the data was restored, the issue went away on its own.

The number of impacted users may sound grim, but given the legions of people who use Facebook, it’s actually a drop in the bucket.  Even so, Facebook’s response was immediate, decisive, and the company took actions to reassure its user base that the issue had been resolved and they would take steps to see that it did not happen again.

Nice words, but given the intense scrutiny Facebook has been under in recent months, blunders like this one only underscore that the company still has a lot of work to do where privacy is concerned.

LTE Networks May Be Vulnerable To Hacking

by

Researchers from Ruhr-Universität Bochum and New York University in Abu Dhabi have discovered serious security flaws in 4G LTE networks that allow hackers to spy on, listen in on, intercept, and disrupt phone calls and text messages.

Given that billions of people rely on 4G LTE networks for cellphone communications, it’s a serious issue, and there are no easy fixes. So, don’t expect these flaws to be patched out of existence any time soon.  Worse still, the planned 5G networks currently in development may well suffer from the same (or similar) flaws.

Based on their research, the team was able to develop a trio of new attacks that specifically target weaknesses in the 4G LTE architecture.

One of these, dubbed “aLTEr” is a DNS spoofing attack that allows a hacker to become the “man in the middle,” intercepting communications, and gives them the ability to spoof alerts, texts, and other messages.

All three of the attacks developed by the team take advantage of weaknesses found in “Layer Two” of the LTE network.

This is the data layer that rests atop the physical channel.  Its function is to maintain wireless communication between users and the network itself, and has an organizational function that (among other things) manages how users access various resources on the network, helping to protect data via encryption and to correct errors in transmission.  Obviously, a hack that can exploit this layer could be devastating indeed.

If there’s a silver lining, it lies in the fact that these three attacks are exotic. It would be difficult for a casual or even a fairly determined hacker to execute to any real effect.  Unfortunately, it would be a much easier task for a state-sponsored group to pull off, and that’s the big fear here.

Hopefully, since 5G networks are still in the planning stages, something can be done before they’re rolled out to limit the effectiveness, or perhaps even negate these new types of attacks, but that remains to be seen.

Microsoft Edge Mobile Browser Blocks Android And iOS Ads

by

As most people know, Microsoft Edge was the company’s “reboot.”  After trying for years to patch and update their beleaguered Internet Explorer, Microsoft ultimately decided to scrap it and start fresh.  Since Edge’s launch, it has struggled to gain traction with users.

Recently, Microsoft has upped the ante, at least where Edge for iOS and Android devices are concerned.  A recent update sees the browser outfitted with a built-in ad blocker.  Prior to the update, if you wanted an ad blocking solution, you’d have to download and install it separately.  This move saves users a step, and gives you one less thing to think or worry about.

It’s a good move, but that alone is unlikely to give Edge the surge in popularity it needs to catch up with other browsers.

To provide some perspective, currently, Microsoft Edge is installed on about five million Android devices, based on stats from the Google Play Store.  Contrast that with 100 million installs of Mozilla’s Firefox, and more than a billion Chrome installations.

Those are sobering numbers that underscore just how much ground Edge needs to cover to even be playing in the same league as other popular web browsers on mobile devices.  While we don’t have statistics for installs from the Apple Store, it’s hard to imagine that they’d be any better, and, are probably a fair bit lower.

That’s not to say that Microsoft’s move wasn’t good, because it definitely was.  Anything that a company can do to cut down the number of unwanted, annoying, and potentially dangerous ads is a very good thing. Odds are that the company’s recently move will be copied by the major players in the browser world.  Even if it doesn’t boost Edge’s numbers much, that’s a win for anybody who uses the internet.  Kudos to Microsoft for making the change.

Mobile Users Gain Privacy Protection In Supreme Court Ruling

by

There’s some good news from a recent Supreme Court ruling where privacy is concerned, but take it with a grain of salt.

In a recent 5-4 decision, the Supreme Court ruled that law enforcement agencies must obtain a warrant before they can get access to data collected and stored on mobile devices.  Of special significance, the court rejected the “third party rule,” which dates back to the 1970’s and asserts that any data collected by third-parties is automatically devoid of Constitutional protection.

The ruling is undeniably good news, and privacy advocates who have been watching the issue closely hail the decision as a victory for individual privacy. However, it should be noted that in the overwhelming majority of cases, “probable cause” is sufficient for most judges to grant a search warrant to law enforcement officials.

The reality is that probable cause is one of those “squishy” words that can mean wildly different things to different people.  While it serves as a speed bump to accessing data on mobile devices, it’s a relatively modest one that’s unlikely to prevent many instances of law enforcement getting the information they need during the course of their investigations.

All that to say, it’s a good first step, but this ruling alone isn’t enough.  So far, no national government anywhere in the world has been able to craft a set of sensible policies that adequately protect the privacy of individuals on the web.  Corporations collect oceans of data on the consuming public, and increasingly, that data is packaged, resold and used for a variety of purposes.

While most of those purposes are fairly harmless and aimed more at marketing than anything else, other purposes border on or are abuses of the public’s trust.  There are no easy fixes here, but kudos to the Supreme Court for taking an important first step.

New SSD Drive Can Hold 8TB of Storage

by

Good news for the business world in general, and the owners of data centers, in particular.

Mass storage is about to get vastly more efficient thanks to Samsung’s recently launched solid state drive, which manages to pack an impressive 8TB of storage into a delightfully small footprint, measuring just 11cm x 3.05cm.

Not only do the new drives deliver twice the storage capacity of the SSDs used in high-end servers and slim line laptops, but it also has an impressive read speed of 3100 MB/s, and write speeds of 2000 MB/s.  The read speed of the new drive is five times faster than the speeds you typically get from SATA SSDs, and the write speeds are three times faster.

When hyper-scaled, that means that enterprise server system could perform more than a million IOPS in a 2U rack space, and that translates into a significant ROI for large-scale data centers.

It gets even better.  Samsung is planning to release a 512 gigabit version of its 3-bit V-NAND SSD later this year, which will allow significant improvements in processing speeds for big data applications.

What we’re talking about here, ultimately, is storage and processing density.  The new SSD is built with 16 512GB NAND package, stacked in sixteen layers of 256 gigabit 3-bit V-NAND chips that were specifically engineered with massive SSDs in mind.

This allows data centers to triple total system density in the same footprint, and allows for a mind-boggling 576 terabytes of storage in 2U rack servers.

This is paradigm shifting and will make cloud-based service providers even more attractive. The most successful of these already have hyper-scale data centers in place, already have a wealth of experience when it comes to handling Very Large Data sets and experience dealing with applications designed to sift through those mountains of data.  Enterprise users, rejoice!

Vulnerability In Mac OS Went Unnoticed For Years

by

Researchers at Okta Security have stumbled across something big.  Recently, they discovered a flaw in Apple’s OS that would have allowed hackers to completely undermine Apple’s code signing process.

While at first glance that doesn’t sound so bad, the implications are terrifying.  In a nutshell, code signing uses cryptographic “signatures” to verify and validate code.  If code bears the digital signature, it is considered trusted.  If it’s trusted, then it’s given an automatic free pass, straight into the heart of any system.

Unfortunately, this flaw in Apple’s code signing process dates back more than a decade. It was only recently discovered, and purely by chance at that.

An extensive forensic analysis has turned up no evidence suggesting that this exploit was ever used for nefarious purposes, which is the one silver lining in all of this.

Upon discovering the flaw, Okta personnel reached out to Apple and other vendors who could have been impacted by the flaw, including tech giants like Google, Facebook and also smaller players like VirusTotal, Objective Development, Yelp, and Carbon Black.

Apple moved swiftly and has since fixed the issue, so this one can be considered a bullet dodged.

Josh Pitts, an Okta engineer, sums the issue up:

“Different types of tools and products use code signing to implement actionable security; this includes whitelisting, antivirus, incident response and threat hunting products.  To undermine a code signing implementation for a major OS would break a core security construct that many depend on for day to day security operations.”

A completely fair assessment.  Thankfully (at least in this particular case), although the issue was hiding in plain sight, it does not appear to have been exploited before being fixed.  We won’t always be so lucky.

Study Shows People Prefer Alternatives Over Passwords

by

File this one away under “confirming things we already knew.”  A recent study conducted jointly by Blink and Trusona confirmed that people just don’t like passwords very much.

Their study tracked the login behavior of 148 participants over a three-week period.  Without knowing the true purpose of the study, participants were asked to log into a gift idea generation website at least three times a week.

They were given the option of a “classic” (password-based) login, or an “easy” login option, which utilized alternative forms of authentication.

The results should surprise no one, but here are some of the statistics collected during the course of the experiment:

84 percent of participants utilized the easy login at least once

47 percent of participants utilized the classic login at least once

Those who used the easy login had successful logins 78 percent of the time

Those who used the classic login had successful logins 56 percent of the time

Per Robert Capps, a VP for NuData Security,

“This report shows that consumers are ready to move beyond passwords and usernames to more secure authentication methodologies.  Using a multilayered authentication framework that combined behavioral analytics with biometrics allows companies to verify users accurately without adding unnecessary friction and detect any unauthorized activity before it enters the environment.

Multilayered solutions that include these technologies analyze hundreds of data points throughout a session and create an evolving profile of a user across the session.  Passive biometrics and behavioral analytics are technologies that can provide this level of monitoring without adding friction to legitimate users, thus creating more convenient experiences for users.”

Clearly, users don’t like passwords.  Unfortunately, there’s currently no technology on the market capable of the feats Mr. Capps describes.  There are several promising models and products in varying stages of development, but sadly we’re still a ways off from realizing a password-free, hyper-secure login paradigm.  That day is no doubt coming though, and not a moment too soon.

New Trick Lets Hackers Bypass Office 365 Email Security

by

What’s old is new again.

Hackers have recently begun re-deploying a decade-old trick called ‘ZeroFont’ to get around Microsoft’s security filters and deliver phishing and spam emails to Office 365 email accounts.  The gimmick?  Zero-point fonts.

As anyone with even passing familiarity to Office 365 knows, if you’re drafting a document, you can change the font size to suit your tastes and preferences.  What few people realize is that you can use html code to set your font to zero-point size.

Of course, such a move has no practical application in everyday usage, because no one could read a zero-point font.  Hackers, however, can make cunning use of it, and Office 365 is unable to detect the presence of zero-point fonts.  Since they’re not detected, they’re not marked as malicious and sail right through the security filters.

By itself, the zero-point trick is useful, but not inherently deadly.  Unfortunately, it can be combined with other tricks like Punycode, Unicode, or Hexidecimal code to insert malicious commands into what appears to be a totally innocent email.

It gets better (or worse, depending on your point of view).  Just last month, researchers at a company called Avanan discovered that it was possible to use the HTML tag in an email or Office 365 document, point it at a malicious site, and the security filters would blithely ignore it.

Again, it should be noted that these tricks aren’t new.  They’ve been around for years, fell out of favor in preference for newer techniques, and now are being recycled.  Apparently, they’re so old that they skate right past modern security flags and filters.

Expect updates soon to catch these types of things, but in the short run, just be aware these types of attacks are not only possible, but trivial to execute.

Contact Info

740 Greenville Blvd. SE., Ste. 400-374
Greenville, NC 27858

Phone: (252) 565-1235