Technology News – Page 10

Passwords May Be Dead Soon If Microsoft Gets Its Way

June 7, 2018 by Joseph Martin

Karanbir Singh (a program manager at Microsoft) is on a mission:

Kill the password.

As he said in a recent blog post:

“Nobody likes passwords. They are inconvenient, insecure, and expensive. In fact, we dislike them so much that we’ve been busy at work trying to create a world without them–a world without passwords.”

The company’s stated goal is to make it possible that an end user will never have to bother with passwords on a day to day basis and would instead provide credentials that are virtually impossible for hackers to crack or breach.

To accomplish this goal, the company is looking at a number of options, including biometrics and multi-factor authentication schemes.

Singh notes that this isn’t just blue-sky thinking, either. Already, more than 47 million users and more than five thousand businesses are utilizing “Windows Hello for Business.” Another solution currently in use is the Microsoft Authenticator app, which allows users to access their Microsoft accounts via their smartphones.

Additionally, as part of the Windows 10 update issued in April (2018), any user with a Managed Service Account or Azure Active Directory can now access their Windows 10 PC without having to enter their password, via the authenticator app and Windows Hello (provided that S-mode is enabled).

The company is also taking advantage of the newly ratified Fast Identity Online (FIDO2) security protocol, and is in the process of updating Windows Hello to enable secure authentication across a wider range of scenarios. For example: The company is currently working on a proof of concept for shared PCs that will allow users to log on via FIDO2 security keys, which will allow employees to carry their credentials with them.

They envision a scenario in which any user can simply walk up to any device the organization controls and authenticate without ever having to enter their username or password. This would be especially useful for analysts, help desk personnel, and anyone working in the medical profession.

Obviously no firm time-frames have been given, but as mentioned, some of these technologies are already in use and will be refined in the months ahead.

Joseph Martin

President & CEO
I hope you enjoyed this article. My mission is to take your stress away from dealing with IT problems. Call (252) 565-1235 or send me a message at our contact us page if you have a question, comment or want help.

Coca Cola Breach Proves Employees May Be Significant Threat

June 6, 2018 by Joseph Martin

Coca-Cola is the latest company to fall victim to a data breach. Unlike some of the others that have recently made headlines, however, this one was conducted from within.

In September 2017, an employee at one of the company’s subsidiaries stole an external hard drive containing personal data belonging to more than 8,000 company employees. Law enforcement officials notified the company when the drive was confiscated, but urged them not to make a public announcement regarding the incident until their investigation had been concluded.

Coca-Cola complied with this request, which is why we’re only hearing about it now. Once the company got the green light from law enforcement, they notified all impacted personnel via a letter, which included::

“Our investigation identified documents containing certain personal information for Coca-Cola employees and other individuals that was contained in the data held by the former employee. We do not have any information to suggest that the misappropriated information was used to commit identity theft.”

As is becoming standard practice in the aftermath of such incidents, the company also announced that it would offer one free year of identity monitoring to the people impacted by the breach.

This latest announcement serves to drive home one of the main points made in a recently conducted survey, “The Global State of Information Security Survey 2018,” which concluded that insider threats are one of business’ top security concerns.

This breach is significantly smaller in both scope and scale than some of the others we’ve seen so far this year. However, the company is still suffering backlash, which has impacted both the trust of its employees and the company’s stock price. As of now, the company’s stock price is down nearly 4 percent over the last three months, with additional losses likely in the near term.

Joseph Martin

Now Is A Good Time To Upgrade To SSD Drives

June 5, 2018 by Joseph Martin

If you’ve been considering swapping out some of your old HDDs to SSDs, now is a great time to do so, thanks to the convergence of two factors.

First is the fact that the manufacturers of SSDs have been making strides in terms of increasing the capacity of the drives they’re offering. They are doing this while simultaneously offering other enhancements that reduce data duplication, making their products faster and more efficient than their HDD counterparts.

Second is the fact that there is currently a dramatic oversupply of memory chips, which has been allowing SSD manufacturers to lower the prices of the products they’re selling.

According to a recently released report from DRAMeXchange:

“The oversupply will continue in NAND Flash market, where suppliers face the pressure to consume production capacity.”

The company is anticipating that the average price of enterprise PCIe SSDs and SATA SSDs could fall by ten percent or more over the course of the next quarter. Further, the firm notes that the enterprise SSD market has been growing at a blistering pace. This year, they expect that the sales of SSDs will top 30 million units, up from less than 20 million just last year, and the company expects a similar rate of growth for at least the next three years.

It seems that businesses of all shapes and sizes are enthusiastically lining up behind SSD technology, and with good reason. Not only are the prices increasingly attractive, but manufacturers are really going the extra mile by offering a raft of new capabilities, in addition to more overall storage capacity.

Obviously, this convergence of factors won’t be long-lived, so if you’ve been planning to upgrade your equipment, now is the time to do so before the winds change direction and prices start to increase again.

Joseph Martin

More Bad News From The Equifax Breach

June 2, 2018 by Joseph Martin

The news just keeps getting worse for Equifax. The company has already had to revise their estimates of how many people were impacted by last year’s breach more than once, and now, they’re having to revise their estimate yet again. This latest revision comes after company officials had to testify before Congress, which has been formally investigating the matter.

Prior to the release of Equifax’s latest “statement of record,” here’s a snapshot of how bad the data breach was:

5 million consumers had their Social Security numbers compromised

99 million consumers had address information exposed

3 million consumers had gender information exposed

3 million consumers had their phone numbers exposed

209,000 consumers had their credit card numbers exposed

97,500 consumers had their Tax Identification numbers exposed

Now, in addition to all of that, the company is adding the following:

6 million consumers had their driver’s license numbers exposed

12,000 had their Social Security and Taxpayer ID cards exposed

3200 consumers had their passports exposed

An additional 3000 had other documents, such as military and state ID’s compromised

As bad as it looks that the company has to keep revising their estimates upward, there’s a logical reason for it. The data that was stolen didn’t come from a single database. On top of that, the databases themselves all had highly variable structures, which has made it exceedingly difficult for forensic analysts to accurately assess the extent of the damage. All that to say, since the process is still ongoing, we may see yet another upward revision of the scope and scale of the breach.

Of course, the company is doing what most companies do in cases like these: They’re offering a year’s worth of free credit monitoring to impacted customers. The ironic part of their offer though, is the fact that Equifax is offering their own credit monitoring service free for a year, which converts to a paid monitoring service after the year is up. As Congressional officials rightly pointed out, this means that the company is essentially profiting off of its own breach, which is disturbing to say the least.

Joseph Martin

New Vulnerability May Expose Encrypted Emails

June 1, 2018 by Joseph Martin

Security researchers at the Electronic Frontier Foundation (EFF) have discovered a dangerous new email vulnerability called “Efail.” Exploiting this new email vulnerability would allow hackers to decrypt emails encrypted with either PGP or S/MIME – including emails that were sent several years earlier. Both of these encryption tools are commonly used by politicians, journalists and other professionals who need a secure means of electronic communication. Since the standards are so well established, they’re used widely and regarded as fool-proof. Sadly, that’s no longer the case.

EFF researchers had this to say about the newly discovered vulnerability:

“In a nutshell, Efail abuses active content of HTML emails (for example, externally loaded images or styles) to exfiltrate plaintext through requested URLs. The attacker changes an encrypted email in a particular way and sends this changed encrypted email to the victim. The victim’s email client decrypts the email and loads any external content, thus exfiltrating the plaintext to the attacker.”

In simpler terms, it’s about as bad as it could possibly get. Once a hacker has access to your email account, they can use the embedded HTML tags inside your mail to force your email system to decrypt those messages so the hackers can see exactly what they contain.

EFF’s recommendation is that if you rely on either PGP or S/MIME for email encryption, your best bet is to simply disable them, and uninstall the tool or tools used to decrypt those messages.

It should be noted however, that there are others in the security community who disagree with this assessment. A spokesman for ProtonMail tweeted out the following response:

“Efail is a prime example of irresponsible disclosure. There is no responsibility in hyping the store to @EFF and mainstream media and getting an irresponsible recommendation published (Disable PGP), ignoring the fact that many (Engimail, etc.) are already patched.”

Despite the divided opinion, if it’s something you’re concerned about, you can neatly side step the problem by simply opting for plain text messages, rather than using HTML-emails.

Joseph Martin

SSD Drive Makers Adding Features To Reduce Duplicate Data

May 31, 2018 by Joseph Martin

Big changes are in the works in the SSD-based storage ecosystem. It includes three different vendors all making similar announcements regarding designs to help companies that rely on SSD-based storage systems to reduce duplication and control data creep.

It’s not hard to see why they’re scrambling. Although the price of SSD-based storage systems are coming down, it’s a slow process. Currently, a gigabyte’s worth of SSD storage costs about forty cents, versus about five cents per gigabyte of HDD storage. Less data duplication means less data to store, making the SSD drives utilizing the new technology more efficient.

Here’s a quick overview of the solutions offered by the three major vendors in this space:

Hitachi – Hitachi is working to upgrade all-flash F-Series and its hybrid flash/hard disk G-Series of drives, as well as its SVOS operating system. The improvements to the operating system include new AI-based container and operations support and introduced a new feature in the form of the “Hitachi Infrastructure Analytics Advisor.” This provides real-time analysis of your data center optimization across all storage devices, networks, servers and virtual machines in a bit to more efficiently predict data center needs and optimize/troubleshoot data storage.

HPE – The company has upgraded their “Nimble” storage line, which includes an array of all-flash products, a hybrid disk-flash product line and a secondary flash line. The big change here is that the company’s products now support inline, variable block size deduplication. The company claims this change makes their products “the most efficient hybrid arrays in the industry by a wide margin.”

IBM – IBM has issued an upgrade to its Storwize arrays, the first in more than two years. The update improves cloud integration, overall disk performance and an array of enhanced deduplication tools, claiming as much as a 5:1 data reduction while retaining 100 percent data availability (provided you’re using IBM HyperSwap).

How big an impact these changes will have remains to be seen, but kudos to all three companies for taking decisive steps to bolster the performance of their storage devices.

Joseph Martin

Chili’s Is The Latest To Suffer A Credit Card Breach

May 30, 2018 by Joseph Martin

Brinker International (the parent company of the Chili’s restaurant chain) formally announced that on May 11, they discovered malware on an undisclosed number of their point of sales terminals. Details are sketchy at this point, because the investigation is still ongoing, but the company had the following to say about the incident:

“If you used your payment card at a Chili’s restaurant between March and April 2018, it does not mean you were affected by this incident. However, out of an abundance of caution, we recommend that you remain vigilant and consider taking one or more steps to avoid identity theft, obtain additional information, and protect your personal information.”

Among other things, the company is recommending that all customers who have dined at a Chili’s restaurant during the period when the malware was active should contact one of the national credit reporting agencies and set up a fraud alert or a security freeze. You should, of course, also closely monitor the payment card you used, to be sure that you recognize all of the charges hitting that particular payment card.

At this point, it is unknown exactly how many Chili’s locations were impacted, nor exactly how many customer records were compromised. It could be weeks, or even months before we have those details, so the company’s recommendation is a good one.

So far, Brinker’s handling of the aftermath of the issue has been exemplary, and based on that, we have every reason to expect that they’ll continue to handle well to its conclusion. The problem is that we keep seeing successful breaches like this because the hackers are changing their tactics more quickly than company IT resources can adapt and respond to. Until and unless that changes, we’ll be treated to more reports like this.

Joseph Martin

Your Kids’ Personal Info May Have Been Compromised

May 29, 2018 by Joseph Martin

An identity threat company called 4iQ has recently published a report called “Identities in the Wild: The Tsunami of Breached Identities Continues.” Unfortunately, the information in the report contains all bad news. Some of the details are simply confirmations of things we already knew, and some are shocking statistics that will leave you feeling dismayed.

For instance:

Cybercriminals and hackers are getting increasingly sophisticated – This isn’t new, but it’s even worse than that. While there are still a few “lone wolf” type hackers, organized syndicates are increasingly coming to the fore. Their collaboration with each other is accelerating the development of ever-more-advanced tactics. New threats are emerging at a much faster pace than data security personnel can respond.

Personal data breaches are now the second most common cybercrime on the planet, with corporate data breaches not far behind. The reason hackers are increasingly gravitating toward hacks of individuals has everything to do with the fact that most people have little to no security. It’s just low-hanging fruit. Corporate hacks are a bit more difficult, but as we’ve seen via the constant parade of headlines, these tend to be more far-reaching, with a scope and scale that can impact tens of millions of users, or more.

There has been a shocking 182 percent increase in the number of identities available on the Darknet belonging to children.

This last point is beyond disturbing. Bad enough that your own personal and confidential data is at risk, but now your kids are increasingly at risk too. Hackers are using their information to apply for credit cards, rent cars and hotels, and more.

In addition to the obvious dangers of hackers around the world knowing everything there is to know about your kids, it can also irreparably damage your kids’ credit, long before they ever have an opportunity to make use of it. A grim report that bears close reading.

Joseph Martin

Vega Stealer Malware Goes After Your Saved Credentials

May 29, 2018 by Joseph Martin

There’s a new security threat to be worried about, and security professionals are warning that it could be very bad indeed. The new malware is known as the “Vega Stealer,” and is currently being used in a relatively simplistic phishing campaign designed to harvest financial data that has been saved in both Google Chrome and Firefox browsers. Unfortunately, based on an analysis of the code, it could be a much more serious threat.

Vega Stealer isn’t 100 percent original work, but rather, is a variant of another nasty bit of malware known as “August Stealer.” Built on the .NET framework, it’s designed to ferret out and steal cryptocurrency wallets, passwords, cookies, saved credit cards, and more.

If your computer is infected, and you’re using Firefox, Vega Stealer will specifically target the files “key3.db” and “key4.db,” along with “cookies.sqlite” and “logins.json,” which store a variety of keys and passwords.

In addition to that though, it can also take screen captures of your PC and scan for, and steal any file with the following extensions:

.pdf

.xlsx

.xrft

.docx

.doc

Of course, it would be a trivial matter for the owners of the malware to expand this list even further.

As mentioned, the current campaign isn’t terribly sophisticated, relying on emails bearing titles like “Online Store Developer Required.” The emails being sent contain a poisoned file called “brief.doc” which contains macros designed to install the malware.

If the recipient clicks on the word doc, it will install a file named “ljoyoxu.pkzip” in that user’s “Music” directory, and then automatically executes the file so it can begin harvesting.

Researchers from Proofpoint, who found the malware strain had this to say:

“The document macro utilized in this campaign is a commodity macro that we believe is for sale and used by multiple actors, including the threat actor spreading Emotet banking Trojan. However, the URL pattern from which the macro retrieves the payload are the same as those used by an actor we are tracking who distributes the Ursnif banking Trojan, which often downloads secondary payloads such as Nymaim, Gootkit, or IcedID. As a result, we attribute this campaign to the same actor with medium confidence.”

Be on your guard.

Joseph Martin

Fitbit and Google Partnership May Raise Privacy Concerns

May 26, 2018 by Joseph Martin

Depending on which side of the privacy debate you’re on, you’re either going to love or hate this announcement:

“Fitbit intends to use Google’s new Cloud Healthcare API to help the company integrate further into the healthcare system, such as by connecting user data with electronic medical records.”

Rarely has a single sentence been so fraught with risk, while simultaneously promising such great opportunity.

On the plus side, the potential for innovation is virtually unlimited, and this new partnership will no doubt be a boon for the still-struggling wearables market. There are also potential increases in health care delivery efficiency, but the privacy concerns surrounding the issue are very real.

One has to only think back to the recent Allscripts fiasco, in which some 1,500 healthcare providers found themselves impacted by a nasty ransomware attack.

Google already collects copious amounts of data on its users, and with Fitbit angling to tap into healthcare records, the amount of private and personally identifiable information collected on users is bound to grow exponentially.

In addition to that, depending on exactly what data Fitbit attempts to link, it could very well make them a “business associate” from a HIPAA perspective. This can expose one or both companies to increased liabilities and vastly stricter standards on how the data can be used, and the steps that must be taken to safeguard it.

Right now, those details are very much in the air, and the issue could go either way. But there are some legal experts who believe that Google and Fitbit will be able to skirt the issue sufficiently so that they will not gain the “business associate” classification.

For Fitbit’s part, the company had this to say: “We have a longstanding commitment to privacy and data, and our data practices will continue to be governed by the Fitbit Privacy Policy. We are not sharing our user data with Google, we are partnering with Google to host Fitbit user data, similar to other cloud/hosting service providers. We take our obligation to safeguard users’ personal information very seriously and are committed to protecting the privacy and security of our users, while being transparent about our data practices.”

Comforting words, but they have done little to allay the concerns of privacy advocates, who see any number of negative outcomes associated with the new partnership. This is a debate that will no doubt be continuing for quite some time to come.

Joseph Martin

« Previous Page
1
…
8
9
10
11
12
…
22
Next Page »

Passwords May Be Dead Soon If Microsoft Gets Its Way

Coca Cola Breach Proves Employees May Be Significant Threat

Now Is A Good Time To Upgrade To SSD Drives

More Bad News From The Equifax Breach

New Vulnerability May Expose Encrypted Emails

SSD Drive Makers Adding Features To Reduce Duplicate Data

Chili’s Is The Latest To Suffer A Credit Card Breach

Your Kids’ Personal Info May Have Been Compromised

Vega Stealer Malware Goes After Your Saved Credentials

Fitbit and Google Partnership May Raise Privacy Concerns

Contact Info

Navigation