Group items tagged

"The disclosure points to a problem security researchers have been warning about for years: that despite its reputation for building what is seen by millions of customers as a secure product, some believe Apple's closed culture and fear of negative press have harmed its ability to provide security for those targeted by governments and criminals. "Apple's self-assured hubris is just unparalleled," said Patrick Wardle, a former NSA employee and founder of the Mac security developer Objective-See. "They basically believe that their way is the best way. And to be fair … the iPhone has had incredible success. "But you talk to any external security researcher, they're probably not going to have a lot of great things to say about Apple. Whereas if you talk to security researchers in dealing with, say, Microsoft, they've said: 'We're gonna put our ego aside, and ultimately realise that the security researchers are reporting vulnerabilities that at the end of the day are benefiting our users, because we're able to patch them.' I don't think Apple has that same mindset.""

The US National Security Agency (NSA) knew of the Heartbleed flaw in the widely used OpenSSL security tool and exploited it for year - instead of blowing the whistle so that the patch could be flawed."

"An automated process is better-suited for a variety of other machine-readable forms of identification, said Vahid Motevalli, a professor at Tennessee Tech University and a flight security expert. For example, a person can't read bar codes, but even if they could, they wouldn't be as efficient as an automated process. A machine can almost always check in more people per hour than a security official, meaning security lines would move much faster."

"The secure email service used by US whistleblower Edward Snowden has shut down rather than comply with orders from US security services - and is also legally barred from speaking out. The owner and operator of Lavabit, Ladar Levison, took the service down yesterday "for maintenance" before revealing today that the real reason was demands from US intelligence."

"According to a report by Sophos, malware and spam are on the rise on social networks such as Twitter, MySpace, Facebook and LinkedIn. In the last year, 57% of users report they have been spammed via social networking sites, an increase of 70.6% compared to last year. Furthermore, 36% of users claim they've been sent malware via social networking sites, which is a rise of 69.8% from last year. On the other hand, CEOs of companies are concerned that their employees' usage of social networks is posing a security risk for their company. Sophos has surveyed more than 500 organizations, discovering that 72% of them think social networks are a danger for their companys, with 60% of them tagging Facebook as the biggest security risk, followed by MySpace, Twitter and LinkedIn. Graham Cluley, senior technology consultant for Sophos, says that Facebook is the biggest threat because it's the biggest social network out there, but he also places some of the blame on Facebook's own privacy rules. "When Facebook rolled-out its new recommended privacy settings late last year, it was a backwards step, encouraging many users to share their information with everybody on the internet," he says. Interestingly enough (and contrasted to some of the reports we've seen lately), Cluley thinks that simply barring access to Facebook is not the solution. "Social networks can be an essential part of the business mix today," he says, "and the answer is not to bar staff from participating in them but to apply some 'social security' instead.""

"When people connected to the hotspot, the terms and conditions they were asked to sign up to included a "Herod clause" promising free Wi-Fi but only if "the recipient agreed to assign their first born child to us for the duration of eternity". Six people signed up. F-Secure, the security firm that sponsored the experiment, has confirmed that it won't be enforcing the clause."

"Marlinspike's Textsecure has an impeccable reputation as a secure platform, and Whatsapp founder Jan Koum attributes his desire to add security to his users' conversations to his experiences with the surveillance state while growing up in Soviet Ukraine. However, without any independent security audit or (even better) source-code publication, we have to take the company's word that it has done the right thing and that it's done it correctly."

"GCHQ, the UK's spy agency, designed a security protocol for voice-calling called MIKEY-SAKKE and announced that they'll only certify VoIP systems as secure if they use MIKEY-SAKKE, and it's being marketed as "government-grade security." But a close examination of MIKEY-SAKKE reveals some serious deficiencies. The system is designed from the ground up to support "key escrow" -- that is, the ability of third parties to listen in on conversations without the callers knowing about it."

" respite was thanks to a sloppy bit of programming from the worm's creator, who'd left a killswitch in the code: newly infected systems checked to see if a certain domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com) existed before attempting to spread the infection; by registering this domain, security researchers were able to freeze the worm.The respite was thanks to a sloppy bit of programming from the worm's creator, who'd left a killswitch in the code: newly infected systems checked to see if a certain domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com) existed before attempting to spread the infection; by registering this domain, security researchers were able to freeze the worm. But a day later, it's back, and this time, without the killswitch. Security researchers running honeypots have seen new infections by versions of the worm that can spread even when the iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com domain is live."

"But when you dive into the code of Meitu, that's where things get interesting. Security researchers have jumped in to assess the photo editing app and found that it was indeed collecting information, including a phone's IMEI number (a handset's unique ID number), and sending it back to remote servers:"

Family feels that they shouldn't have to pay for a security system that doesn't work!

"The adoption of security chips has not slowed credit card fraud, either. 60,000,000 US credit cards were compromised in the past 12 months and 90% of those were chip-enabled. The majority of compromised cards were stolen by infected point-of-sale terminals. The US has the worst credit card security in the world. The findings come from a Gemini Advisory report, which blames a "lack of chip compliance" in merchants for the rise."

"Serious security flaws that could let attackers steal sensitive data, including passwords and banking information, have been found in processors designed by Intel, AMD and ARM. The flaws, named Meltdown and Spectre, were discovered by security researchers at Google's Project Zero in conjunction with academic and industry researchers from several countries. Combined they affect virtually every modern computer, including smartphones, tablets and PCs from all vendors and running almost any operating system."

"Cybercriminals are targeting people using Apple products as they are more likely to have disposable income, a security expert has warned. Blogger Graham Cluley said that while malware was more common on Windows, Apple customers could not "afford to be lackadaisical" about security. On Monday, he reported a text message scam that tried to trick people into handing over account information. Apple's support site warns customers not to enter details on spoof sites."

"Experts now believe that criminals could 3D-print hands complete with fingers and fingerprints to defeat security precautions at banks, airports and police stations."

"Security researcher Troy Hunt reports that the snuggly spies, from Spiral Toys, Security researcher Troy Hunt reports that the snuggly spies, from Spiral Toys, "represents the nexus" of the problem with internet-connected appliances and toys: children being recorded, data being leaked, and the technical possibility of surreptitious access to children through networked toys. "The best way to understand what these guys do is to simply watch the video [advertisement for the toy].""

"Silent Circle, a secure communications company founded by PGP creator Phil Zimmerman, has pre-emptively shut down its secure, encrypted email service and destroyed the servers so that it cannot be forced to reveal its customers' secrets to NSA spooks. "

"One of the most widely used tools for monitoring and restricting pupils' internet use in UK schools has a serious security flaw which could leave hundreds of thousands of children's personal information exposed to hackers, a researcher has warned."

"First, the journalists working with the documents. I've handled some of the Snowden documents myself, and even though I'm a paranoid cryptographer, I know how difficult it is to maintain perfect security. It's been open season on the computers of the journalists Snowden shared documents with since this story broke in July 2013. And while they have been taking extraordinary pains to secure those computers, it's almost certainly not enough to keep out the world's intelligence services."

"Upcoming cell phone chips from Qualcomm will use artificial intelligence to block malware before it infects your phone. The chip company said on Monday that the next-generation Snapdragon 820 processor used in a variety of Android smartphones will be the first chip that uses machine learning to detect threats and privacy issues thanks to an application called Snapdragon Smart Protect." Qualcomm is trying to use artificial intelligence in a chip for smart phones. The chip will learn to detect any privacy or security issues that would usually be hard to detect.