security – Page 14

Mi-Cam Baby Monitor Video Feeds Vulnerable To Hacking

March 14, 2018 by Joseph Martin

Do you have a Mi-Cam in your home? Even if you don’t have kids, you may have one. They’re a highly popular, inexpensive means of keeping tabs on the comings and goings inside your home when you’re not around.

As with so many such devices these days, users have the option of installing either an Android or iOS app on their phones so they can peek in remotely, any time they like, and therein lies the problem.

It’s no secret that the IoT is filled with “smart” devices that don’t live up to their name when it comes to security, and the Mi-Cam is no exception. Security researchers have discovered that the communications between the company’s cloud servers where the video feeds live and the smartphones of the product’s user based are not secure.

So far, six different vulnerabilities have been identified, all of them critical. Any one of them would allow a hacker to hijack the window into your video feed and use that to scroll through literally every video feed on the company’s cloud, regardless of who owns it. All told, that’s more than fifty thousand video feeds, accessible from a single point of entry.

It gets worse. The attack is trivial to perform, because no SSL certificate is needed. All that’s required is a copy of either the Android or iOS mobile app.

The manufacturer of the Mi-Cam has been notified of these critical security flaws, but as of now, none have been addressed. The company has not released any information about when they might be. In light of that, if you have one, your best bet is to simply stop using it until the company can at least employ some rudimentary security protocols.

Joseph Martin

President & CEO
I hope you enjoyed this article. My mission is to take your stress away from dealing with IT problems. Call (252) 565-1235 or send me a message at our contact us page if you have a question, comment or want help.

Google Calls Out Microsoft For Security Issue

March 10, 2018 by Joseph Martin

Depending on who you ask, Google’s Project Zero is either the thing that’s going to singlehandedly save the internet, or the bane of many companies’ existence. It’s easy to see both sides of the argument.

On one hand, by uncovering previously undiscovered bugs in all manner of software and handing that information over to the authors, Google is undeniably performing a valued public service. The problem has never been with the “carrot” side of the equation, always with the stick.

The stick is this: Google gives each company 90 days in which to address the bug. If they take no action during that time, then Google will announce the existence of the bug to the world, which of course, means that hackers everywhere immediately have access to a new exploit.

This approach often accomplishes what contacting the vendor privately does not. Once the bug becomes common knowledge, the company in question is essentially forced to fix the problem, thus making the internet safer.

It should be noted that Google does allow exemptions to the 90-day rule. If a company is hard at work on a fix and needs more time, Google has been known to delay their announcement. In a similar vein, if a bug is simply catastrophic in scope and scale, the company has been known to make the announcement to help deploy resources of multiple companies toward addressing the issue.

More than 90 days ago, the Project Zero team discovered a pair of security flaws in Microsoft products. One in their Edge browser, and the other in the Windows 10 OS. One of the two got fixed. The other did not, and Google called them out for it.

Needless to say, Microsoft is not pleased, and they have hit Google back for such behavior in the past. They scored a PR victory last year when Microsoft engineers discovered a flaw in Google’s Chrome browser, and contacted the company privately so they could fix the issue and then bragged about their more responsible approach after the fact.

It will be interesting to see what Microsoft does in this instance.

Joseph Martin

Android Ransomware Infections Declined in 2017

March 8, 2018 by Joseph Martin

Android users have a reason to cheer. According to the latest report by ESET, the number of ransomware attacks targeting Android devices declined in 2017. The decline represents a bit of an anomaly, given that in 2017, the most common type of malware attack (by a wide margin) was ransomware. Given that security researchers can’t name a particular reason for the decline, it’s important not to read too much into the data. Whether there are declining figures or not, ransomware attacks still played a prominent role in last year’s threat landscape across a whole spectrum of devices. This year is shaping up to be no different.

Where Android-based ransomware attacks were concerned, several old standbys were still seeing frequent use, including both Charger and SimpleLocker. The most prominent new player in 2017 was DoubleLocker, which was first seen in the wild last October. It is unique in that it was the first Android malware to take advantage of a vulnerability in the Accessibility service to gain admin rights and infect users.

Interestingly, Android-based banking Trojans have been abusing the Accessibility service for literally years. It’s not immediately clear why hackers didn’t begin using it as an attack vector where ransomware was concerned until the appearance of DoubleLocker. Now that it’s on the scene, we can expect to see an increasing number of similar attacks.

In any case, given the fact that ransomware is poised to dominate the threat landscape in 2018, all users would do well to stay on their guard. The slight decline in ransomware attacks against Android users, (while a welcome sight), is probably going to be short-lived. If there’s one thing you can be sure of, it is that 2018 will be another record-breaking year where hacking attacks are concerned.

Joseph Martin

New Apple Update Available for Character Bug Solution

March 6, 2018 by Joseph Martin

Recently, another “exotic character” bug was found in iOS. If someone sends this particular character (a special character that’s part of the Indian language pack) to your phone via any messaging app, it will not only crash your phone, but cause a variety of messaging apps to stop functioning.

When the bug was initially reported, Apple treated it as a somewhat low priority item and announced their plan to fix it with the release of iOS 11.3 later this spring. The company’s loyal user base, however, had other ideas. Faced with a growing chorus of demands for a more immediate fix, Apple has incorporated it into the 11.2.6 release which is now available.

If you’re set up to automatically receive OS updates, there’s nothing for you to do, and if you haven’t already encountered this issue, you never will. If, on the other hand, you are in the habit of manually applying OS updates, this is one you won’t want to miss. While the chances of someone sending this exotic character to you are quite low, there’s nothing to be gained by exposing yourself to needless risk.

Long time users of Apple’s products will recognize a trend here. This is hardly the first time an exotic character or other unusual event has caused iOS to crash. Just last month, there was a similar (though less serious) issue with another special character. Last year, it was discovered that a properly formatted URL could crash any system running iOS. Not long after that discovery was made, a five second video went viral that, if watched on a device running iOS, would crash it.

In any case, the user base spoke and Apple listened. Grab the latest update and you won’t have anything to worry about. At least until the next unusual crash bug is discovered.

Joseph Martin

IRS Labeled Email Could Contain Ransomware

March 5, 2018 by Joseph Martin

There’s a new strain of the “Rapid Ransomware” making the rounds, and because of how it’s being transmitted, it’s destined to have a higher than average rate of infection. The new strain was first discovered by Derek Knight. It is disturbing because it claims to come from the IRS, and will feature subject lines like “IRS Urgent Message-164.”

The body of the email then goes on to say that the recipient owes some amount of money in real estate taxes, and “helpfully” includes instructions for how to settle in the attached file. Inside the zipped file, the user will find a word document. You’ll need to click on “Enable Editing” to see the file, and unfortunately, the moment you do, you’re doomed. “Rapid” will scan the target computer for data files and encrypt them, appending each with the “.rapid” extension.

As soon as the malware finishes encrypting your files, it will automatically open “Recovery.txt” which will display details on how much you’ll have to pay the hackers to get your files back. Unlike most other ransomware strains, this one will configure itself to start every time you login to the computer, so if you pay the ransom to get access to your files again, but fail to completely remove the malware, you’ll be facing the same problem the very next time you use the machine.

Observant users will take note of the fact that the email address is not a .gov and likely not be taken in. Unfortunately, many people will look no further than the subject line and immediately begin following the instructions contained in the email, which is obviously the reaction that the hackers are hoping for.

As ever, protecting yourself from threats like these comes down to two things: Education and vigilance.

Joseph Martin

40 Percent Of All Login Attempts Are From Bots

March 5, 2018 by Joseph Martin

Here’s a statistic that is as disturbing as it is frustrating. According to the latest “State of the Internet/Security” report for the fourth quarter of 2017, as published by Akamai, bot-traffic accounts for a staggering 43 percent of all login attempts. As bad as that figure is on its face, it’s far worse for companies in the hospitality industry, where the figure is an almost unbelievable 82 percent.

The reason? Hackers are increasingly using bots to perform “credential stuffing” attacks.

Although human traffic still dominates the web, bot traffic is rapidly catching up. According to Akamai’s estimates, not counting streaming video, bot traffic accounts for 30 percent of the total, and that figure increases every year. In fact, even though bot traffic is still a minority in absolute terms, some industries already see more bot traffic than human traffic.

TicketMaster is a great example of this. The web’s premier site for purchasing concert tickets online is almost unusable by humans these days, because virtually all of their traffic is bot-driven, with bots often being used to buy every available ticket the moment they become available, so they can be resold later at a hefty premium.

Akamai’s Martin McKeay had this to say about the report: “Increased automation and data mining have caused a massive flood of bot traffic to impact websites and internet services. Although most of that traffic is useful for internet businesses, cyber-criminals are looking to manipulate the powerful volume of bots for nefarious gains. Enterprises need to watch who is accessing their sites to differentiate actual humans from both legitimate and malicious bots. Not all web traffic and not all bots are created equal.”

These are wise words, and it bears some consideration. How much of the traffic coming to your business website on any given day is human?

Joseph Martin

2018 Olympics Hit By Malware

February 27, 2018 by Joseph Martin

Hackers are picky about their victims. They’ll target just about any group or organization, including the 2018 Olympics.

Cisco’s Talos Group recently identified a new strain of malware they’ve dubbed “Olympic Destroyer” which is wreaking havoc in Pyeong Chang’s computer networks and causing downtime to internal WiFi and television systems. This has impacted the games’ opening ceremonies, and stands an excellent chance of further disrupting the rest of the festivities.

Because the threat was only recently discovered, the Talos team’s initial assessment and report was spotty and short on details, but the group recently amended their initial findings. The results aren’t pretty, and the malware is seen as being both more dangerous and more advanced than originally thought.

The big three findings in the team’s amended report are as follows:

It’s Polymorphic – As the malware spreads, it collects new credentials from each machine it infects, adding these to its binary on the fly. Members of the Talos team had this to say about the behavior: “I have not seen a malware sample modify itself to include harvested creds before and I’ve been doing this stuff longer than I should admit. Polymorphic malware isn’t a new idea by itself, but I’ve never seen any examples of malware modifying itself to include harvested credentials.”

It Spreads Via The EternalRomance Exploit – This bit of information comes to us from the Windows Defender team. The mechanism by which Olympic Destroyer spreads is industrial grade, utilizing an exploit from the NSA leaked by the Shadow Brokers last year.

Finally, It Wipes Data – This is perhaps the most significant of the three updates to the Talos report. The malware has a data wiping mechanism built into it that it utilizes at every opportunity in an attempt to delete files on network shares. Since it only seems to target shared files, it’s not deleting items key to OS functionality. Even so, these shared files are important, and this is what’s causing operational disruptions.

More details will no doubt become available as the various teams researching Olympic Destroyer get a better understanding of what they’re looking at. The bottom line is, it’s a pretty advanced threat and will likely inspire copycats in the months ahead.

Joseph Martin

Smart TV’s May Be Tracking You And Vulnerable To Hacks

February 27, 2018 by Joseph Martin

Do you own a smart TV? More than half of all television sales in the US last year were smart TVs, so chances are decent that you own one. If you do, be aware that it may be collecting far more data about you than you think.

Recall that last year, Samsung, (one of the top smart TV manufacturers) found itself in hot water when it was revealed that the TV could listen in on conversations, record them (for better voice recognition) and save them on a Samsung server.

Those issues still persist to varying degrees, but a recent Consumer Reports study underscores something most people in the tech business have known all along. Smart devices really aren’t all that smart, at least when it comes to security.

The Consumer Reports study concluded that most smart TVs and associated technologies like the Roku have only the most rudimentary of security features and can easily be hacked, giving the hackers total control of your TV. This includes the ability to turn it off, on, change the channel, and monitor your viewing habits. Given that, these TVs can also be voice-controlled. Once a hacker is in control of your set, he could monitor any conversations that take place near it without your knowledge.

In addition, the most recent smart TVs come with a feature called Content Recognition. For example, if you watch the latest episode of the Walking Dead (whether on AMC or Amazon Prime or some other streaming service), the next time you pull up a web page on your PC or smart phone, you’ll start seeing advertising related to the Walking Dead.

This, of course, gives any would-be hacker a much deeper view into your viewing habits and history.

The upside is that most of these features can be deactivated if you have the patience to sift through the television’s menu system. Of course, if you do that, then it’s no longer a smart TV, and thus, not worth the extra money you spent on it.

As ever, the bottom line is this: These kinds of risks aren’t going to go away on their own. Until and unless smart device makers start taking security more seriously, we’re going to keep hearing about potential or actual abuses.

Joseph Martin

Google Will Get Tougher On Websites Not Using HTTPS

February 27, 2018 by Joseph Martin

Google is poised to make an important change to its Chrome browser beginning in July 2018.

Here’s the summary from Emily Schechter, the Google Chrome Security Product Manager:

“For the past several years, we’ve moved toward a more secure web by strongly advocating that sites adopt HTTPS encryption, and within the last year, we’ve also helped users understand that HTTP sites are not secure by gradually marking a larger subset of HTTP pages as ‘not secure.’ Beginning in July 2018 with the release of Chrome 68, Chrome will mark all HTTP sites as ‘not secure.'”

All the major browsers already have plug-ins that alert users anytime they’re visiting a non-secure (HTTP) website, but Google’s planned move will likely prompt them to incorporate the notification into their core product as well.

According to Google’s statistics, 81 of the top 100 sites (as ranked by traffic volume) already use HTTPS. In addition to that, Google reports that 68 percent of Chrome users are finding HTTPS when using Android and Windows, and 78 percent of the time when using Mac OS X, iOS, and Chrome OS. Those figures are markedly higher than they were in 2010, when an estimated 40 percent of websites were using the secure socket layer.

If your company’s website hasn’t already made the switch, the time to do so is now. The writing is clearly on the wall, and it’s not hard to imagine that after Google begins “shaming” non-secure sites with the notification, they’ll also start implementing penalties that will hurt their position on search results pages. Even if they don’t, the persistent non-secure warnings will be enough to keep many users away, so it doesn’t matter how well optimized or SEO-friendly your site is, an increasing percentage of users may simply opt out if it’s not secure.

Joseph Martin

Changes To Google Images Will Make Image Theft Difficult

February 27, 2018 by Joseph Martin

Image theft is one of the biggest problems on the internet. If you’re a photographer, you’ve almost certainly lost money because people find your work online and make a copy of it rather than paying for the right to use it.

Unfortunately, Google has made that incredibly easy to do, but that’s changing. Until recently, if you did a Google image search, you’d get a list of images that matched your search phrase, and one of the buttons displayed was a “View Image” button that would take you to the image file itself, as opposed to viewing the image in the context of whatever web page it was displayed on.

This, of course, made stealing the image a trivial task. Content providers have been complaining loudly, and Google listened. Effective February 15, the “View Image” button is no longer listed. Of course, it’s still possible to steal the image in question, but users will have to jump through at least a couple more hoops to do so.

A second, smaller and somewhat less impactful change is the fact that Google has also removed the “Search By Image” button that formerly appeared when you navigated straight to an image file. Savvy users will still be able to drag the image itself to the search bar and accomplish the same thing, but relatively few people are aware of this, which will cut down on its use significantly. The thinking here is that netizins were making use of this feature to find copies of images that didn’t have a watermark visible.

While these two changes give photographers reason to cheer, it definitely negatively impacts the user experience, as there are a number of perfectly legitimate uses for copyrighted image material. The bottom line is that if you’re accustomed to the old way of searching for and acquiring images, you’ll have a bit of an adjustment period ahead.

Joseph Martin

Mi-Cam Baby Monitor Video Feeds Vulnerable To Hacking

Google Calls Out Microsoft For Security Issue

Android Ransomware Infections Declined in 2017

New Apple Update Available for Character Bug Solution

IRS Labeled Email Could Contain Ransomware

40 Percent Of All Login Attempts Are From Bots

2018 Olympics Hit By Malware

Smart TV’s May Be Tracking You And Vulnerable To Hacks

Google Will Get Tougher On Websites Not Using HTTPS

Changes To Google Images Will Make Image Theft Difficult

Contact Info

Navigation