You can see the larger original version here.
Showing posts with label Security. Show all posts
Showing posts with label Security. Show all posts
Sunday, 13 April 2014
Be Still My 'Bleeding'Heart'
This infographic from 10 TopTen Reviews, highlights some of the major trends in the malware industry and reveals several interesting statistics about computer viruses.
You can see the larger original version here.
You can see the larger original version here.
Wednesday, 9 April 2014
Would Sir Like Malware With His Meal?
Just when you thought it was safe to get back into the (digital) water, after ditching Window XP and upgrading your home or office PC, comes the news that hackers managed to get into an oil company's' systems through a Chinese takeaway menu!
Yes... you read correctly, this ingenious restaurant menu hack was the key to grabbing crucial company data.
How did they do it? According to the report in the New York Times, "hackers infected with malware the online menu of a Chinese restaurant that was popular with employees. When the workers browsed the menu, they inadvertently downloaded code that gave the attackers a foothold in the business’s vast computer network".
This form of infiltration is referred to as watering hole attack. Just as predatory crocodile lurks by a watering hole in the Masai Mara ready to pounce on a thirsty gazelle, so does this malware await its opportunity.
And no, before you ask, I doubt if Edward Snowden every set foot in this restaurant but it does go to prove just how clever and pervasive cybercrime has become.
Any system or device that uses software is now prone to these types of attack whether it be climate control systems, printers or even vending machines. Once you can break into one device you have a pathway to break into an enterprises' entire system. I doubt if many people truly appreciate the sophistication and cunning of today's cyber criminals and spooks.
The NYT article also details that 23-70% of attacks dealt with by network security agencies emanate from third party devices. It is also worth mentioning that many of the devices mentioned above such as vending machines (and surprisingly ATMs) still run of Windows XP and as of this month, Microsoft has ceased its support for this software leaving it even more vulnerable.
30% of the world's personal computers still run on Windows XP which represents a massive challenge to stopping the proliferation of malware. If you have a spare £5.5m you can always do what the UK government has just done and buy yourself some extra breathing space. But for most mere mortals such as yours truly, this was not an option.
Ransomware attacks, which as the same suggest hijack and lock a system until a ransom is paid, grew by 500% in 2013. Cryptolocker is the best known of this type of malware.
I have made a mental note to be more careful when selecting from a menu in a restaurant in the future. The 'Chef's Special' may not turn out to be quite what it seems at first glance.
Yes... you read correctly, this ingenious restaurant menu hack was the key to grabbing crucial company data.
How did they do it? According to the report in the New York Times, "hackers infected with malware the online menu of a Chinese restaurant that was popular with employees. When the workers browsed the menu, they inadvertently downloaded code that gave the attackers a foothold in the business’s vast computer network".
This form of infiltration is referred to as watering hole attack. Just as predatory crocodile lurks by a watering hole in the Masai Mara ready to pounce on a thirsty gazelle, so does this malware await its opportunity.
And no, before you ask, I doubt if Edward Snowden every set foot in this restaurant but it does go to prove just how clever and pervasive cybercrime has become.
Any system or device that uses software is now prone to these types of attack whether it be climate control systems, printers or even vending machines. Once you can break into one device you have a pathway to break into an enterprises' entire system. I doubt if many people truly appreciate the sophistication and cunning of today's cyber criminals and spooks.
The NYT article also details that 23-70% of attacks dealt with by network security agencies emanate from third party devices. It is also worth mentioning that many of the devices mentioned above such as vending machines (and surprisingly ATMs) still run of Windows XP and as of this month, Microsoft has ceased its support for this software leaving it even more vulnerable.
30% of the world's personal computers still run on Windows XP which represents a massive challenge to stopping the proliferation of malware. If you have a spare £5.5m you can always do what the UK government has just done and buy yourself some extra breathing space. But for most mere mortals such as yours truly, this was not an option.
The Year of the Mega Breach
Symantec's most recent Internet Security Report 2014 labelled 2013 as the Year of the Mega Breach as the number of attacks were 62 percent greater than in 2012, with 253 total breaches. Eight of the breaches last year exposed more than 10 million identities each! |
| Source: Symantec Corporation - Internet Security Threat Report 2014. |
I have made a mental note to be more careful when selecting from a menu in a restaurant in the future. The 'Chef's Special' may not turn out to be quite what it seems at first glance.
Tuesday, 6 August 2013
Bathroom Attack of the 'Apless Apps
We live in a time where NSA and PRISM, the Internet of Things and Mobile Apps dominate online and off-line chatter.
Sometimes convergence of these technologies can come together in the most unexpected of ways leaving the user wondering why more robust user testing wasn't in place before release. And in the context of this article I use the term "release" advisedly!
Those of you who have ever stayed in a Japanese hotel will know that the toilets are high tech with a series of buttons designed for an internal car wash, post purge.
The Satis Smart Design boasts the most sophisticated of toilet innovation according to its manufacturers Laxil, one of Japan's biggest toilet companies. It's mouth-like lid opens automatically to greet you as you draw nigh and when you step away the toilet flushes automatically.
There is now even a free Android app with a hard-wired Bluetooth code available which means you can operate the Satis remotely, all of which sounds fine in theory. There is however one fatal flaw that the manufacturers have failed to realise in their rush for innovation - their high tech toilet can be hacked.
IT security firm Trustwave has issued a Bluetooth security vulnerability warning that the app could be hacked. Trustwave issued an advisory that a pin for the Bluetooth app is set at '0000' and can therefore be used by anyone - even remotely. In short, anyone with the 'My Satis' app can control any Satis toilet.
While it remains to be see if bidet hacking will become as popular as gangam style dancing, the temptation for pranksters is obvious. Facing a cyber attack in the bathroom from an out of control two-nozzle bidet spray could have dire consequences.
Sometimes convergence of these technologies can come together in the most unexpected of ways leaving the user wondering why more robust user testing wasn't in place before release. And in the context of this article I use the term "release" advisedly!
Those of you who have ever stayed in a Japanese hotel will know that the toilets are high tech with a series of buttons designed for an internal car wash, post purge.
The Satis Smart Design boasts the most sophisticated of toilet innovation according to its manufacturers Laxil, one of Japan's biggest toilet companies. It's mouth-like lid opens automatically to greet you as you draw nigh and when you step away the toilet flushes automatically.
There is now even a free Android app with a hard-wired Bluetooth code available which means you can operate the Satis remotely, all of which sounds fine in theory. There is however one fatal flaw that the manufacturers have failed to realise in their rush for innovation - their high tech toilet can be hacked.
IT security firm Trustwave has issued a Bluetooth security vulnerability warning that the app could be hacked. Trustwave issued an advisory that a pin for the Bluetooth app is set at '0000' and can therefore be used by anyone - even remotely. In short, anyone with the 'My Satis' app can control any Satis toilet.
 |
| Trustwave advisory |
Wednesday, 19 June 2013
As Strong As Your Weakest Link
Outsourcing key data activity to contractors rather than keeping it in-house means your online security is only as good as their employees are; in keeping mum about what they discover about your operations in the course of their daily duties.
Consider the fact, expounded by James Sensenbrenner in a recent editorial, that there are some 500,000 employees of private firms with access to the government's most sensitive secrets. And this is just the States. There are surely more in other countries contracted to undertake similar surveillance.
Some regard the actions of Manning, Assange and Snowden as heroic and others consider them heinous, but which ever side of the the ethical debate you sit on, the fact remains that confidential data was accessed and shared with those it wasn't intended for.
It is a sobering realisation (or maybe reconfirmation) that it is the low level IT guy who poses your greatest threat. These techs seem to be able to rummage through systems and make discoveries that evade all of the so-called safeguards that the governments throw at them.
Consider for a moment what you might have accessed online or sent to others via email in the past year. I would suggest that many people who would feel less than comfortable in having a total disclosure of their online habits revealed to the world without their permission.
But is there anything you can do to mitigate the risk that others can and do spy on what you do?
Part of the answer could well have been given by NSA whistle-blower Snowden. In reply to an online discussion set up by the Guardian newspaper he said that:
"Encryption (of email) works. Properly implemented strong crypto systems are one of the few things that you can rely on. Unfortunately, endpoint security is so terrifically weak that NSA can frequently find ways around it".
So there you go. Even encrypting your email can only assure safe passage between systems and if the systems themselves have a weakness an IT tech on a mission can crack it or share it. Not the most comforting of thoughts and if the technician in question has a thumb-drive (as Snowden is reported to have by Senator Saxby Chambliss of Georgia), then your data could be shared and leaked well beyond the boundaries of your network.
Am I alone in thinking that these revelations could well have profound implications for the future of the Cloud? The 'contracting out' of data storage from your own servers to a third party based in another country could well have become a far more difficult decision for businesses to make.
And if you wish to mitigate some of the damage your email might cause you could always try using encryption yourself. Here is one suggestion: GNU Privacy Guard for Windows which is free software. Mind you I cannot guarantee that a low-level tech at the NSA hasn't already cracked it.
Monday, 31 December 2012
2013 - The Year Ahead - Lucky For Some?
Here is a snapshot of the mega-trends and predictions for 2013.
A cloud-based data locker has been described by CNN as "part virtual safe and part personal digital assistant.
"Dave Siegel, author of Pull: The Power of the Semantic Web to Transform Your Business, argues these cyber vaults will eventually replace PCs, tablets, iPhones, and Microsoft's (MSFT) Windows and Apple's (AAPL) Macintosh operating systems. Yes, Google (GOOG) Android, too."
2. Home Sweet Home:
The Connected Home is a component of the Internet of Things; where devices talk to devices, in many cases without human intervention.
Cloud-based smart home systems allow you to monitor and control your house from your smart phone, tablet, or computer, no matter where in the world you are at the time. An example of this is Lowe's Iris system.
Iris can be installed directly by the home owner and the basic level of monitoring service is free. This includes text alerts to the home owner when alarms are triggered; remote control of connected devices, thermostats and locks; and access to remote video streaming from cameras in the home via smart phone or computer. Lowe has partnered with AlertMe to produce this product.
3. Programmatic buying will get bigger
Programmatic buying allows advertisers to bid, often in real time, on ad space largely based on the value they have assigned to the consumer on the other side of the screen. It uses a range of technologies to achieve this. As this New York Times article notes, "major advertisers and many of the world’s largest ad agencies creating private exchanges to automate the buying and selling of ads."
4. A Sense of Touch and Smell
IBM believes that in the future computer devices will be able to mimic our ability to touch, taste, smell and hear. Sophisticated algorithms will be able to analyse why people like certain tastes and the chemical structure of food.
5. Cyber Security or insecurity?
If you own a cyber security company you could be in the money as many predict that banks and other online transactions sites, who have been seen a surge in cyber attacks, are anticipating that these will get even more sophisticated as time goes by. As a result these entities will increasingly turn cyber security firms to combat these intrusions.
We are still slack about cyber security matters. A recent study found that 35% of all data required data protection in 2010, but despite this, less than 20% of it is actually protected.
Ericka Chickowski, writing for Dark Reading believes that security research firms will turn away from less lucrative vendor contracts in 2013 and instead sell the information they glean about software vulnerabilities on the open market.
"Cyber-mercenaries are becoming more protective of their discoveries as the technology involved becomes more complex and the secrets more valuable".
Now this should be a worry to all as these cyber-mercenaries don't need to reveal who they have sold their research to although some like Vupen are on record as saying that they wouldn't sell their findings to oppressive governments or criminals.
eWEEK has also compiled some 2013 predictions to help organisations prepare to counter increasingly sophisticated hacks and malware.
6. The amount of Data will grow and grow.
By 2020 that amount of data on planet earth will be 40 Zettabytes; one Zettabyte is 2 to the 70th power bytes. According the Computer Weekly that equates to 57 times the number of all the grains of sand on all the beaches on earth. I 'll have to take their word for it as counting grains of sand is simply soporific! Machine generated data is the main contributor to this increase, rising from the current 11% of all data top 40% by 2020.
Juniper Research predicts the following for wireless in the year ahead:
CIO sees an end to offshore outsourcing. IT robots and autonomic systems will be taking over. So you will no longer need to be an engineer to create software or intelligently manage IT infrastructure. An example is Blue Prism; giving companies a software development toolkit and methodology to create their own software robots to automate rules-driven business processes. According to the company there are significant cost savings with its robot full-time equivalents (FTEs) costing a third of offshore FTEs.(video below)
And finally, the digital playing field is levelling out thanks to Cloud computing with developing countries able expand their role in the global economy. The University of California, San Diego's Dean of International Relations and Pacific Studies, Peter F. Cowhey, and Senior Fellow at the Institute on Global Conflict and Cooperation, Michael Kleeman, found that Third World countries can now utilise the cloud in the same way developed countries have in the past. This is due to the lower costs, resulting in higher Internet adoption rates.
Emerging market businesses can now access similar storage, compute, and uses application services as the Global 2000 do.
- Your personal data locker will become increasingly important to you and, if you haven't got one you already, you should probably consider it.
"Dave Siegel, author of Pull: The Power of the Semantic Web to Transform Your Business, argues these cyber vaults will eventually replace PCs, tablets, iPhones, and Microsoft's (MSFT) Windows and Apple's (AAPL) Macintosh operating systems. Yes, Google (GOOG) Android, too."
2. Home Sweet Home:
The Connected Home is a component of the Internet of Things; where devices talk to devices, in many cases without human intervention.
Cloud-based smart home systems allow you to monitor and control your house from your smart phone, tablet, or computer, no matter where in the world you are at the time. An example of this is Lowe's Iris system.
Iris can be installed directly by the home owner and the basic level of monitoring service is free. This includes text alerts to the home owner when alarms are triggered; remote control of connected devices, thermostats and locks; and access to remote video streaming from cameras in the home via smart phone or computer. Lowe has partnered with AlertMe to produce this product.
3. Programmatic buying will get bigger
Programmatic buying allows advertisers to bid, often in real time, on ad space largely based on the value they have assigned to the consumer on the other side of the screen. It uses a range of technologies to achieve this. As this New York Times article notes, "major advertisers and many of the world’s largest ad agencies creating private exchanges to automate the buying and selling of ads."
4. A Sense of Touch and Smell
IBM believes that in the future computer devices will be able to mimic our ability to touch, taste, smell and hear. Sophisticated algorithms will be able to analyse why people like certain tastes and the chemical structure of food.
 |
| Download a copy |
If you own a cyber security company you could be in the money as many predict that banks and other online transactions sites, who have been seen a surge in cyber attacks, are anticipating that these will get even more sophisticated as time goes by. As a result these entities will increasingly turn cyber security firms to combat these intrusions.
We are still slack about cyber security matters. A recent study found that 35% of all data required data protection in 2010, but despite this, less than 20% of it is actually protected.
Ericka Chickowski, writing for Dark Reading believes that security research firms will turn away from less lucrative vendor contracts in 2013 and instead sell the information they glean about software vulnerabilities on the open market.
"Cyber-mercenaries are becoming more protective of their discoveries as the technology involved becomes more complex and the secrets more valuable".
Now this should be a worry to all as these cyber-mercenaries don't need to reveal who they have sold their research to although some like Vupen are on record as saying that they wouldn't sell their findings to oppressive governments or criminals.
eWEEK has also compiled some 2013 predictions to help organisations prepare to counter increasingly sophisticated hacks and malware.
6. The amount of Data will grow and grow.
By 2020 that amount of data on planet earth will be 40 Zettabytes; one Zettabyte is 2 to the 70th power bytes. According the Computer Weekly that equates to 57 times the number of all the grains of sand on all the beaches on earth. I 'll have to take their word for it as counting grains of sand is simply soporific! Machine generated data is the main contributor to this increase, rising from the current 11% of all data top 40% by 2020.
Predictions from other sources.
Juniper Research predicts the following for wireless in the year ahead:- Big Data to Become Big Business
- Smart Glasses & Other Wearables: 2013, the year of ‘announcements’
- BYOD trend on the rise, as security issues escalate
- Retail to embrace the in-store mobile strategy
- Operators to adopt seamless WiFi & LTE connectivity
- Mobile Becomes the Connectivity Hub
- The Year of Microsoft
- The multi-screen, seamless user experience becomes a reality
- New mobile and tablet form factors to emerge
- Social Gaming is on the Rise
CIO sees an end to offshore outsourcing. IT robots and autonomic systems will be taking over. So you will no longer need to be an engineer to create software or intelligently manage IT infrastructure. An example is Blue Prism; giving companies a software development toolkit and methodology to create their own software robots to automate rules-driven business processes. According to the company there are significant cost savings with its robot full-time equivalents (FTEs) costing a third of offshore FTEs.(video below)
And finally, the digital playing field is levelling out thanks to Cloud computing with developing countries able expand their role in the global economy. The University of California, San Diego's Dean of International Relations and Pacific Studies, Peter F. Cowhey, and Senior Fellow at the Institute on Global Conflict and Cooperation, Michael Kleeman, found that Third World countries can now utilise the cloud in the same way developed countries have in the past. This is due to the lower costs, resulting in higher Internet adoption rates.
Emerging market businesses can now access similar storage, compute, and uses application services as the Global 2000 do.
Saturday, 19 November 2011
Password Puffery - Do Any Of These Look Familiar?
- password
- 123456
- 12345678
- qwerty
- abc123
- monkey
- 1234567
- letmein
- trustno1
- dragon
- baseball
- 111111
- iloveyou
- master
- sunshine
- ashley
- bailey
- passw0rd
- shadow
- 123123
- 654321
- superman
- qazwsx
- michael
- football
So if any of the above ring a bell you may wish to quickly change them. You can also try any prospective password by running it through this test. I tried a new password out and was gratified to learn that it would take some 39,000 years to hack!
Word of caution: I would not however try out any existing passwords on a third party site such as this as you can not be sure how secure the site itself is.
Word of caution: I would not however try out any existing passwords on a third party site such as this as you can not be sure how secure the site itself is.
Related articles
Saturday, 7 May 2011
Facebook Pages Take-Down Policy
There have been a number of complaints from businesses who found Facebook's decision to take down their sites, rather arbitary.
A Sophos security advisor states what he thinks Facebook should be doing in the above video.
Thursday, 16 December 2010
Head In The Cloud/s
"The Cloud" has become an almost repetitive term in the past decade, but the withdrawal of service by Amazon.com for WikiLeaks demonstrates a potential and strategic weakness.If cloud-based services can be influenced in such a way by governmental pressure, will businesses feel comfortable putting all their transactional eggs into this online basket?
With the above in mind consider the implications of the recently launched Google Chrome operating system, which all intents and purposes has turned the Chrome browser into an cloud-based operating system.
Google CEO Eric Schmidt says:
"With Chrome OS, we have in development a viable third choice in desktop operating systems. Before there was no cloud computing alternative—now we have a product which is fast, robust and scalable enough to support powerful platforms. It’s something computer scientists have been dreaming about for a very, very long time. The kind of magic that we could imagine 20 years ago, but couldn’t make real because we lacked the technology".
While ChromeOS does not handle flash very well at this time, such glitches are to be expected during its testing period.
Where Google hopes it will beat its competitors is in speed and security; two business essentials. The four guiding security principles for the product have been:
- The perfect is the enemy of the good.
- Deploy defenses in depth.
- Make it secure by default.
- Don't scapegoat our users.
As Jeremy A. Kaplan of Fox News put it:
"Stop worrying about when the hard drive in your computer will die. Google wants to kill it permanently anyway"
But the nagging question still remains, are users and businesses prepared for a shift to purely cloud-based computing?
Amazon's action may have given them pause for thought.
Monday, 29 November 2010
Getting Tough But Will It Work?
Illegal file sharing and counterfeit goods sites are in for a shock. The US Government has commenced a domain seizure programme in an attempt to close these illegal traders down.
According to CNet News, the seizures came after a Senate committee unanimously approved a controversial proposal earlier this month that would allow the government to pull the plug on Web sites accused of aiding piracy.
A division of the Department of Homeland Security, Immigration and Customs Enforcement (ICE),is handling the crackdown.
Not surprisingly there are critics of this action. CBS News and CNET Technology Analyst Larry Magid says
"This is a very controversial practice, which of course is supported by companies in the video and motion picture and music business, but opposed by some civil rights activists and organizations who feel that it's an improper use of government authority, because it's shutting down an entire domain in an attempt to get at some allegedly infringing material".
It also begs the question how effective such a programme of seizure actually is? Pirate Bay for example, is still up and running despite its principals being found guilty in a court of law.
In addition, to prosecute pirates there needs to be evidence and this resides on a server, not within a domain name.
Without a server no warrant can be issued and without a warrant, a prosecution cannot proceed. To try and do so without following this due process would seem to contravene the USA's Fourth Amendment.
There a number of avenues available for site owners to circumvent these restrictions. The US Government can only seize US-registered domain names so there is nothing to stop a US citizen registering a site in an off shore registry.
The Internet will respond to such censorship by finding a way around it, a process which has become the norm. The pirates will no doubt do likewise.
In another court ruling, this time in the UK, it has been decided that news monitoring agencies will have to pay publishing companies foer the use of their web content.
According to The Telegraph which reported the verdict:
"Headlines are now considered separate literary works, and thus subject to copyright, which means that clients of aggregation websites that charge for a service will have to pay for a license in order to use headlines, links and short extracts from online stories".
Saturday, 28 August 2010
Scary Ideas About Privacy
There have been a number of disconcerting revelations about platform privacy in recent times. Facebook has drawn a lot of flak for introducing Facebook Places which has the ability to pinpoint where a person is accessing their account and entering data.
Not every one wants this information available to third parties. If you don't wish to have Digital Big Brother knowing your every move then you should go to your account and do the following:
In earlier statements Eric Schmidt would have us believe that we should not have any secrets and that the virtuous Google is better at maintaining our privacy than a government; I think not.
The other flaw in this post-adolescent name change idea is that the inference that upon reaching adulthood one becomes sin-free. There maybe be super mortals in this category but I have yet to meet one.
Stephen Colbert skewers Schmidt on the privacy issue in this video.
Valleywag has got even hotter under the collar over this issue and lists six delusions of Google's arrogant leaders.
Of course the other side of the coin is that it is not Google's responsibility to dictate to users what they should or should not put online.
There has to be a level of personal responsibility and if a person is silly enough to ruin their own reputation on the web, whose fault is this?
Not every one wants this information available to third parties. If you don't wish to have Digital Big Brother knowing your every move then you should go to your account and do the following:
- Go to Account which is at top right of the screen
- Account settings
- Notifications
- Scroll down to Places
- Uncheck the 2 boxes
In earlier statements Eric Schmidt would have us believe that we should not have any secrets and that the virtuous Google is better at maintaining our privacy than a government; I think not.
The other flaw in this post-adolescent name change idea is that the inference that upon reaching adulthood one becomes sin-free. There maybe be super mortals in this category but I have yet to meet one.
Stephen Colbert skewers Schmidt on the privacy issue in this video.
| The Colbert Report | Mon - Thurs 11:30pm / 10:30c | |||
| The Word - Control-Self-Delete | ||||
| ||||
Valleywag has got even hotter under the collar over this issue and lists six delusions of Google's arrogant leaders.
Of course the other side of the coin is that it is not Google's responsibility to dictate to users what they should or should not put online.
There has to be a level of personal responsibility and if a person is silly enough to ruin their own reputation on the web, whose fault is this?
Tuesday, 20 July 2010
Smart Billboards Target Consumers
The Digital Signage Promotion Project is currently being tested for a year by a consortium of 11 Japanese railway companies.
Twenty seven high-tech advertising boards now grace the subway stations around Tokyo and while face recognition software is being used, the companies are quick to assure commuters that no recorded images will be stored.
Only data related to groups of people will be held. This information relates to categories of people, which ads they look at and the times of day when they do so.
Subscribe to:
Posts (Atom)