Tag: data security

Article

Beware of Risky Ads on Tumblr | MalwareBytes Unpacked

My Comments

Ads on sites like here need to be secure to obtain the same respect as magazine ads

Most of us who use the Web are making increased use of ad-sponsored Web sites for news, blogs, social media and the like.

In most cases, the banner advertising that appears on these Websites or on advertising-funded mobile-platform apps and is delivered in a tasteful manner provide a similar experience to the display advertising we see, accept and take for granted in newspapers, magazines and other printed media. That is where pop-up or pop-under advertising isn’t used or you don’t hear noisy video commercials playing through. It could be enough to see an animated or slide-show ad appear within the confines of the banner. Here, the advertising doesn’t interrupt the reading experience unlike with TV advertising or online-video advertising where it interrupts the viewing experience.

Such advertising, like the Google AdSense ads you see on this site, is sold on a contract that is based on cost-per-click which the advertiser pays when you click on the ad to follow through with it, or cost-per-impression which is based on simply on the ad being loaded and appearing on the site.

The malvertisement threat

But there is a security problem cropping up here in the form of “malvertisements”. These are online advertisements that are delivered to lead users to Websites that host malware. Typically they use enticing copy and graphics in the advertisements to attract users to view content on these sites and download software of questionable provenance.

Security vendors run a rhetoric that encourages us Web users to use ad-blocking software to keep our computer secure by masking all online advertising. But this can get in the way of honest advertisers and the publications that depend on them for revenue because the software works on an “all or nothing” approach.

But what can the online advertising industry do about this?

If a Website author has control over all of the advertising they admit, they can easily “fence out” malvertisements and distasteful advertising by examining what their potential advertiser is tendering at the start of and through the life of their advertising contract.

But this is not the case for most Websites where they will rely on one or more ad networks like Google AdSense to supply all or the remainder of their ad inventory. These ad networks typically source the advertising themselves and pay publishers a cut for each advertisement that appears or when someone clicks on an advertisement.

Ad networks

Malware sites advertise through these networks on a “pay-per-click-only” contract because it is a “low-risk high-return” option. But the networks could make life harder for them by, for example, vetting the creatives (advertising text, graphics, scripts and links) offered for an ad campaign before accepting them for display and through the life of the campaign. Similarly, they could make it harder to establish or sustain advertising contracts for “fly-by-night” operations like distributing malware such as implementing the ability to break-off ad contracts if the advertiser engages in deceptive conduct or not offering “very-low-risk” advertising options such as “pay-per-click-only” text ads. One way would be to require all ad contracts to be based on the requirement to pay for a particular time length or minimum number of impressions.

Ad networks can also exchange details about advertisers that engage in deceptive business practices so that the advertisers don’t go “shopping around” different ad networks to hawk their wares at the lowest risk. This is similar to a lot of proper business practices where companies are able to exchange details about known credit risks for example.

This could be part of an online advertising code of conduct to protect the validity and legitimacy of the online display advertisement as part of an advertiser’s campaign mix and as a way for Web publishers to raise some income.

Webmasters

Webmasters can work with the ad network’s control panel to reduce the kind of advertising that gets through to their ad spaces. For example, they could opt to keep the advertising that appears to tightly reflect the content and tone of their Website. The Webmaster can also exercise a tight level of control over any advertising they directly sell for their Website such as offering contracts with a minimum level of risk to the advertiser or vetting the creative material tendered by the advertisers.

As well, they can take out security measures over the Website to stop undesireable activity from occurring with their Website. This could include implementing hardened login procedures such as brute-force lockout or two-factor authentication on the critical admin and editor accounts.

Conclusion

Like most online-security issues like Wi-Fi security, it isn’t just up to end-users to do the “heavy-lifting” to keep their Web experience secure. Other stakeholders like advertising networks need to join in the game to keep a secure Web with respected online advertising and avoid exposure to liability.

Article

Startup builds intrusion prevention system for home networks | PC World

My Comments

A device that is being used mainly in enterprise networks is the “intrusion prevention system” which is another form of firewall installed at the network’s edge. This device is typically set up between a modem and the router that serves normally as the network’s edge to protect the network from outbound and inbound Internet-based attacks.

Increasingly, as most home networks acquire more devices and more of these devices are programmed with firmware that isn’t “written for security”, these devices are being seen as necessary for home and small-business networks.

Itus Networks are working on one of these devices and optimising it for the home network, so it is as secure as a similar device used in Enterprise America but is more cost-effective and is able to be managed by most householders. The iGuardian product is intended to go between the router and the modem to analysie outgoing and incoming traffic for malicious activity and block such activity based on community or commercial “Snort-form” rulesets.

But this form factor wouldn’t work well with the modem-router which is the way to go for most DSL services, where the modem and router are in one box. Personally, I could see the “intrusion prevention system” become an included feature with high-end routers that are pitched at “enthusiast” consumers, SOHO users or small businesses rather than the low-tier routers sold to most consumers.

Similarly, a functionality gap exists where other network devices could be at danger of intrusion caused by one network device without Internet involvement.

As well, I find that they may not be accepted for most home networks because they may be difficult to operate unless you have a lot of competence with business-grade computing. This may be due to issues like lack of “task-based” or “simple-language” design.

At the moment, this device is showing that the concept of business-grade internet security for the home network in the form of an “intrusion prevention system” is at its early stages and there needs to be a lot more work done to make a mature product for this class of network and the kind of operator that it will face..

The trusted-environment concept for mobile devices

At Google I/O 2014, it was a chance for Google to premiere the next version of Android for the smartphones and tablets; along with officially releasing Android Wear for wearables and Android variants for the car and the TV.

One feature that Google was promoting was the concept of a “trusted environment” for your Android smartphone where you don’t have to unlock the phone with your PIN or “pattern” routine to use it in that environment. Similarly, Apple just lately put forward a patent to implement this same “trusted-environment” concept in their iOS devices. Applications that were highlighted included you home, car or work and this was determined by one or more conditions being true.

For example, using a “voice unlock” routine can equate your voice as being a trusted user. Similarly, being connected to a particular Bluetooth watch or headset which is on and alive, or being in a particular location by virtue of association with a known Wi-Fi network segment or within range of a GPS “bearing” could also relate to a “trusted” environment.  Apple’s implementation also is about about context-based behaviour such as bringing forward or disabling apps that relate to a particular environment, such as showing up a video-on-demand app when at home or disabling apps not safe for use when driving. It could extend to bringing forward a business-specific app like a “handheld electronic menu” for your favourite restaurant or an “online concierge” for your favourite hotel.

A good question is whether this concept of the “trusted environment” could be integrated with the Internet Of Everything? For example, the concept of having your mobile device near a computer or building-security device could be considered trusted as long as you authenticated with that device within a certain timeframe and/or with a particular key such as your own keycard or code.

This concept may not be considered appropriate in locations where there is a risk of your smartphones or similar device being stolen or accessed without your knowledge or permission. Examples of this may be a workplace where public and staff-only areas aren’t clearly delineated or a party or gathering that is happening at home.  Personally, these setups also have to be about user privacy and about working totally to a user’s needs and habits.

It may come to a point where a USB charging device offered by a stranger may be treated with distrust

I have seen some recent press coverage generated especially by the security-software industry about the concept of USB-based charging devices stealing data from smartphones and tablets that normally charge from these devices. This issue was brought to public attention at the start of the World Cup 2014 where the fear that an increased number of travellers pouring in to Brazil for the soccer may be a breeding ground for threats to the safety of personal and business data kept on mobile devices owned by these visitors.

The devices that are being considered of concern are “walk-up” charging facilities installed in commonly-accessible places or made available for everyone to use. The concern was brought about with a laboratory experiment involving a small “homebrew” computer circuit connected to an iPhone running iOS 6 and this computer discovering the data on that device. They said that this device could be concealed in a box the size of a “wall-wart” or built in physically or logically to a “walk-up” charging facility. Here, the device could gain access to your data on an iPhone or iPad running iOS 6 or earlier because those earlier iterations of the iOS operating system don’t indicate in a user-facing manner what kind of host device you are connecting your mobile device to.

USB symbol that indicates that your Android device is connected to a computer device

Android user are luckier because all of the iterations of that operating system indicate whether your mobile device is being plugged in to a computer device rather than a power-supply device and tell you how they are presenting themselves to the host device i.e. a “Media Transport Protocol” device, a “Picture Transport Protocol” device or a “Mass Storage” device.  You have the ability to determine how your device presents itself by tapping on the “Connected as” message in the Notification Screen which will show the possible modes. As well, you will see the USB trident symbol in the Notification Bar at all times while the connection is active.

The “Media Transport Protocol” mode primarily exists to allow the host access to the media content on your device and may be exploited by entertainment setups like home AV devices, in-vehicle infotainment setups and airline in-flight entertainment screens for playback via the device’s screen and speakers or headphones. On the other hand, the “Picture Transport Protocol” mode allows access to the pictures and videos in the default folders on your device and is exploited by PictBridge-capable printers and printing kiosks for “walk-up” printing of digital pictures. As well, the “Mass Storage” device mode presents your device to the host as a USB “memory key”.

USB device type notification on Android

iOS users can protect themselves by bringing their iPhones, iPads and iPod Touches up to date with the latest version of that operating system. Here, iOS 7 and newer versions will pop up a dialog box asking whether the user trusts the computer device that they are plugging in to and if they don’t assent, the Apple connection port just becomes a power-and-audio port rather than a power-audio-data port.

Device types supported on your Android device

Other suggestions to deal with this issue include properly shutting down your mobile device when letting it charge up at a public charging facility or someone else’s computer, or charging it from an AC charger or external battery pack that you own and bring with you. Even ideas like being frugal with the way you use your mobile gadgets in order to “spin out” their battery runtime like cutting back on multimedia or gaming, or turning off functions like Wi-Fi and Bluetooth unless you actually are using them have been put forward.

New iOS 7 dialog box that identifies if the other device is a computing device

The main issue here is keeping your mobile devices on the latest version of their operating system and paying attention to situations where your mobile device identifies that what is ostensibly a charging device is infact a computer device and the host device doesn’t come clear on its functionality.

Personally, it could become the time for the USB specification and other host-peripheral connection specifications to be revised to factor in “privilege levels” and trust ecosystems when it comes to device connectivity. This could mean that a connection may only be a “battery charging / power delivery” connection unless a level of trust is established between both devices as regards their functionality and it could even just lead to a removal of the “plug-and-play” features of these systems.

Articles

IT-focused News

FBI Issues Wanted Posters For Five Chinese Army Officers | Gizmodo

DOJ’s charges against China reframe security, surveillance debate | PC World

US authorities name five Chinese military hackers wanted for espionage | The Register (UK)

General News

US Charges China With Cyber-Spying On American Firms | NBC News

Previous coverage on this topic

Symantec Symposium 2012 – My Observations From This Event

The issue of cybercrime now reaches the national level

My Comments

I have heard and will cite previous coverage about the issue of nation states engaging in cyber espionage against other nation states and businesses within these other nation states. For example, I attended the Symantec Symposium in 2012 and listened to the keynote speech by a guest speaker from the Australian Federal Police and he mentioned about organised crime and nation states engaging in the cyber-espionage or sabotage. He even said that it isn’t just servers or regular computers that were at risk but mobile devices like smartphones, point-of-sale / point-of-payment equipment and other dedicated-purpose computing devices being also at risk.

Subsequently, I watched the ABC Four Corners “Hacked” broadcast which covered the issue of cybercrime reaching a national level. This telecast covered key points including a small business who manufactured electronic equipment for defence purposes that fell victim to a Chinese cyber attack along with the theft of blueprints for ASIO’s new offices,

The recent indictment of Chinese military officers by the US government, along with FBI serving “wanted notices” on these officers has underscored the issue of nation states being involved in cyber espionage. It highlights the theft of intellectual property that private companies or government departments hold close to their heart for economic or strategic advantage.

It was even looked at in the context of the National Security Authority debate regarding cyber surveillance by that government department of Uncle Sam’s especially when there was the leaks that were put out by Edward Snowden, The US President Barack Obama even wanted to establish a global discussion regarding the cyber hacking and surveillance.

It got to the point where Mark Zwillinger, the Department Of Justice lawyer ran this line:The only computers these days that are safe from Chinese government hackers are computers that are turned off, unplugged, and thrown in the back seat of your car. Personally I would take this further by saying that the only computers these days safe from the Chinese government hackers are those that are turned off fully, unplugged and securely locked in the boot (trunk) of a sedan (saloon) or similar car.

As well, it would have us “wake up and smell the bacon” when it comes to nation states, especially those that don’t respect human rights, engaging in cyber warfare.

Article

Apple users: Try these five tips for better Mac security | Naked Security

My Comments

Just lately, I have heard over the dinner table that a few Apple Macintosh computer users have been facing issues with malware and other software with questionable behaviour. Some of these attacks were mainly “overlay attacks” that worked with the user’s Web experience.

What previously used to happen was that Windows computers were the target for viruses, worms, Trojans and similar malware due to them having a stronger installed base compared to the Apple Macintosh platform. This caused some people to switch to the Apple Macintosh platform because of less malware threats occurring on that platform.

But even in 1989 when I was made aware of the virus issue, the awareness about viruses and similar malware was targeted across all personal-computing platforms that were in operation through that year i.e. the MS-DOS-based IBM PC, the Macintosh, the Commodore Amiga and the Apple II amongst others. At that time, there was awareness about keeping a “clean” system and keeping control over how you shared your files.

Similarly, we started to see the arrival of signature-driven anti-virus programs that could scan hard disks or removable “floppy disks” for viruses. Some of these initially scanned the boot sector but moved towards checking files for these viruses. They became a very important part of every computer user’s software toolkit as the virus activity increased. But through the 1990s as the Internet came on the scene, the malware activity was more focused on the MS-DOS / Windows platform with Apple Macintosh users not having as much of that activity. At that time, the MS-DOS / Windows platform was effectively the computing platform for most personal and business computing applications including gaming with the Macintosh being used by creative types due to its inherent prowess with multimedia.

This lead to a sense of complacency concerning secure computing for the Macintosh platform on both Apple’s and their users’ part. Microsoft took proper steps in updating and patching the Windows computing platform since 2001 with the arrival of Windows XP and hardening that platform with the arrival of Windows Vista and 7. Similarly, Windows users jumped over to the Macintosh platform for their home computing because they saw Windows as being slow and virus-ridden; and also due to the arrival of Apple’s iPod and iPhone products.

Lately, the Apple Macintosh has become the target for various malware campaigns including “write-once run-anyone” attacks based on Adobe Flash and Java software platforms. This is due to the increased new-found popularity that the Macintosh has acquired and, in another context, activities involving the Internet, networks or removeable media are still being seen as vectors where the Mac can share Windows-targeted malware.

Upgrade to Mavericks if you can

To stay secure, Apple Macintosh users need to upgrade to the 10.9.2 Mavericks version of MacOS X, with this version being equipped with various security improvements in a similar way to what Microsoft did with Windows 7. This can be done with newer Macintosh computers and for free with Macs running Lion or Mountain Lion versions.

Keep the operating system and software up-to-date

As well, as part of proper computer housekeeping, it is important to keep the Mac “lock-step” with the latest operating-system updates. Here, you can use the Apple-Menu / System Preferences / App Store option to have the Mac check for and download the updates from Apple by itself; or go to the Apple-Menu / Software Update menu to cause it to check for updates. The latter option can be of use with a MacBook that is used “on-the-road” and you are able to check in at a Wi-Fi hotspot or other Wi-Fi network.

Similarly, keep Adobe Flash and Oracle Java up-to-date by using options in the Apple-Menu / System Preferences menu to check for automatic or manual updating for these programs. If any other “write-once run-anywhere” software-development platforms show up on the Macintosh platform, treat these like you would with Adobe Flash – they can become a path for distributing malware that “hits across all platforms”.

This also applies to the application software and utilities you also run on your Mac and, here, you go to whatever software-option menu there is to check for software updates or cause automatic software updating to occur.

Don’t enable Java if you don’t need it.

As for Java which appeals as a “write once run anywhere” coding system, don’t enable it unless you are intending to run a known trusted program that uses this language or are developing Java software. OS X Mavericks comes with this deactivated by default but you can deactivate this in your Web-browser option menus.

Take advantage of full-disk encryption if you have confidential data

Another practice you could use for all computer platforms is to take advantage of full-disk encryption. Most operating systems provide this as a function that you can use with MacOS X providing it “across the board” for recent iterations in the form of FileVault. Similarly, a commercial or open-source third-party full-disk-encryption tool can do the job better than what the operating system provides.

These tools encrypt and decrypt on an “on-the-fly” basis and mainly protect the local volumes on the computer with some business-tier USB memory keys providing a similar full-disk encryption for their own volumes.

Use a good anti-malware or desktop security program for the Macintosh

Check for and use a good anti-malware program for the Mac platform like Kaspersky, Sophos, AVG or ClamXav . As well, keep the anti-malware program that you run on automatic update in order to keep them ahead of the malware game.

It is also worth noting that the good programs in this field can also keep the Macintosh from being a conduit for spreading Windows-based malware around the Windows platform. This is whether the files are passed through email, message-based file transfers, network-hosted / Internet-hosted file sharing points or removeable media.

Another sign of a good anti-malware program is the ability for it to scan your computer’s primary storage (RAM and paging files) to protect against malware that works on data being held in this space. This is because most data normially encrypted on a secondary storage or in transit is kept “in the clear” in the RAM and is vulnerable to RAM-scraping malware.

Keep stock of what is installed on your Mac

Another way malware gets on to computers is when you load software “in a hurry”. Typically what can happen with some freeware tools is that they can “push” browser extensions and toolbars or utilities of doubtful provenance on to a computer. This can lead to it underperforming or malware creeping in and taking over the system.

If you download from the Mac App Store or similar download locations, check for the app’s reputation by looking at comments, star-ratings and the like. This is something I have raised previously in relation to app stores for mobile-computing platforms along with the newer App stores that are opening up for regular computers and dedicated-purpose devices.

With your browsers and other applications, keep tabs on what plugins, extensions, toolbars and other add-on modules are running and if you notice something being awry about the module since you installed, don’t hesitate to remove it. A good article on this topic concerning uninstalling applications on the Mac is this one on MacRumors.com which highlights that dragging an application bundle to the Trash may not be the only method available.

Conclusion

The main issue here is that the Apple Macintosh is a computing platform vulnerable to malware and will become more so as it be becomes more popular as a mainstream computing platform. So you would need to continue with proper computer-housekeeping practices to keep your Mac from these threats.

Article

Vodafone Germany looks to provide end-to-end encryption with SIM signatures • The Register

My Comments

The SIM card could be the heart of corporate-grade end-to-end mobile data security

If a company or person wanted to have highly-secure data or voice communications on their smartphone or tablet, they had to install an “over-the-top” software package and establish a separate password or key for the secure path..

Now Vodafone Germany, who is part of the Vodafone mobile-telephony conglomerate, have worked on a SIM-based setup that they can easily provide as part of a value-added service. This is based around all the passwords and keys being part of the SIM card and software held on the handset making use of these keys along with native apps to provide the secure tunnel.At the moment, this is offered to larger corporate and government customers but could be offered to small business accounts especially as some of these businesses also provide goods and services to the large corporate and government user base

One reason I would suspect that Vodafone have worked on this concept is to provide an easy-to-deploy end-to-end encryption service for consumers and small business in the wake of the Snowden affair. At the moment, the setups would be designed to work with Android devices but with Blackberry and Windows Phone ports being considered. In the case of Windows Phone, this could allow for the concept to be taken further to Windows-based tablets, laptops and desktops which are used for a lot of business computing.

A limitation that I see with the SIM-based solution is that it is dependent on a device having an integrated 3G or 4G modem thus wouldn’t be considered truly “transport independent”. I see this as being of importance as people use Wi-Fi hotspots provided by many different venue hosts and not many of these are kept secure by the venue owners thus making the customers’ data vulnerable. Similarly, this will also be of concern for client-to-box VPN setups where the “other end” of the VPN tunnel connects to the Internet via a fixed WAN connection like cable, DSL or fibre-optic.

This could be a step for mobile carriers and telcos to provide the encryption needed for secure communications especially in the wake of some serious spying scandals.