Apple’s iOS 9 contains a security flaw that lets cybercriminals gain limited access to a device through Siri.
The post iOS 9 security flaw lets attackers access device through Siri appeared first on We Live Security.
Monthly Archives: September 2015
CVE-2015-6303 (spark)
The Cisco Spark application 2015-07-04 for mobile operating systems does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, aka Bug IDs CSCut36742 and CSCut36844.
CVE-2015-6304 (telepresence_server_software)
Cross-site request forgery (CSRF) vulnerability in Cisco TelePresence Server software 3.0(2.24) allows remote attackers to hijack the authentication of arbitrary users, aka Bug IDs CSCut63718, CSCut63724, and CSCut63760.
Got an aging parent? Tell them about the Grandparent scam
Scammers rob elderly victims of an estimated $3 Billion per year.
A scam that has been around since at least 2008 is still active and targeting elderly folks. Seventy-four year old Avast evangelist, Bob Gostischa, who knows a thing or two about scams, security, and privacy, received a call just yesterday from a scam artist attempting to steal money. “If it happened to me, I’m sure it’s going to also happen to others,” said Gostischa.
Scammers target elderly people “because they’re more gullible.”
Here’s the basic premise:
Someone either calls or emails pretending to be your grandchild. The typical story is that they have been wrongfully arrested and need bail money wired right away. Another variation says they are traveling and have been mugged or even in an accident and badly injured. After going through this frantic sob story, and if they sense that their victim is falling for it, the scammer asks for money to be wired through services such as Western Union and MoneyGram.
After the phone call ended, Bob sent us a transcript so we could share it with Avast Blog readers. “I consider myself lucky because the first instinct was wow, how can I help her…?,” he said. “I guess we all really need to be very vigilant at all times.”
Caller: Hello Grandpa, this is your granddaughter. I have laryngitis so I don’t sound like myself
Bob: You certainly don’t. Which granddaughter?
Caller: What do you mean?
Bob: Well, I have several. Caller: Your oldest.
Bob: Oh, OK (Suspicious because she should have said her name.) Is everything OK?
Caller: No.
Bob: What’s the matter?
Caller: I was visiting a friend in Niagara Falls and on my way home, I was involved in a car accident.
Bob: Are you OK?
Caller: Yes, everyone is fine.
Bob: And the car?
Caller: The car is fine. This woman came out of nowhere, and I hit her but she’s OK.
Bob: Thank God.
Caller: Yes, but when the cops came, they asked if I was drinking. I told them no but, because I’m taking medicine for my laryngitis, I failed the breathalyzer and spent the night in Jail.
Bob: Did they assign you an attorney?
Caller Yes, but I need bail money. Can you send me $500.00 via Western Union?
Bob: That’s going to really be hard. We just had some medical bills so things are pretty tight.
Caller: Please Grandpa, can’t you put it on your credit card?
Bob: Sorry, they are all maxed out.
Caller Please Grandpa, I don’t want to stay in jail.
Bob: Sorry sweetie, but I really can’t and don’t have any money I can send.
Caller: click…. she hung up.
“In my case, my oldest granddaughter doesn’t drive and she also wouldn’t be in Niagara Falls,” said Gostischa. “It’s very easy to fall for a scam like this because all of us want to help family – especially our grandchildren.”
Last year, CBS News interviewed a former scammer who worked this game. He said that on a good day he could make $10,000 from the grandparent scam. “We target people over the age of 65, mainly, because they’re more gullible,” the former scammer said. “They’re at home. They’re more accessible. Once you get them emotionally involved, then they’ll do anything for you, basically.”
How to protect yourself from the Grandparent Scam
The FBI’s Internet Crime Complaint Center (IC3) has these suggestions:
- Resist the pressure to act quickly.
- Try to contact your grandchild or another family member to determine whether or not the call is legitimate.
- Never wire money based on a request made over the phone or in an e-mail…especially overseas. Wiring money is like giving cash—once you send it, you can’t get it back.
What to do if you have been a victim
- Contact your local authorities or state consumer protection agency if you think you’ve been victimized.
- File a complaint with IC3, which may refer the case to federal, state, local or international law enforcement or regulatory agencies for possible investigation, or The Federal Trade Commission. You can also call the FTC at 1-877-382-4357 to report a complaint.
Follow Avast on Facebook, Twitter, YouTube, and Google+ where we keep you updated on cybersecurity news every day.
How to keep your digital home as clean as possible
Your computer is your digital home. And just like a home – it eventually gets dirty and needs cleaning. Not dirty in the usual way, mind you. What I am talking about is digital rubbish – bits and pieces of programs you removed a long time ago but are still haunting your hard drives.
The post How to keep your digital home as clean as possible appeared first on Avira Blog.
Samhain File Integrity Checker 4.1.0
Samhain is a file system integrity checker that can be used as a client/server application for centralized monitoring of networked hosts. Databases and configuration files can be stored on the server. Databases, logs, and config files can be signed for tamper resistance. In addition to forwarding reports to the log server via authenticated TCP/IP connections, several other logging facilities (e-mail, console, and syslog) are available. Tested on Linux, AIX, HP-UX, Unixware, Sun and Solaris.
67% of apps for infants are gathering and storing private information
The debate over the convenience of getting a mobile device for your children, or the age at which they should have one, is nothing new. Society seems to have accepted that kids now carry smartphone sin their pockets and the apps that come with them are a lifesaver for parents who are looking for ways to keep their young ones occupied for a short period of time.
However, not all is as it seems when it comes to apps and webpages for infants. Nearly half of them arouse suspicion regarding the information that they require and how they use it, especially concerning sharing it with third-parties.
Because of this, the data protection agencies of 29 different countries around the world (USA and the EU included) have completed an investigation known as the Global privacy Enforcement Network (GPEN), whose mission is to fight for the privacy of citizens on an international level by analyzing the laws that protect them and various ways in which their privacy could be compromised.
41% of the apps and websites analyzed (nearly 1,500 in total) alarmed the investigators in one way or another. More than 61% of the apps saved the user’s information (names, addresses, etc.) and half of the apps shared this information with third-parties (public sector businesses, for example).
Some go even further and offer the underage user to enter their telephone number (22% of those analyzed) and 23% allow them to share videos or phones. Adam Stevens, a member of the British regulating service, describes these results as “worrying” and states that “The attitude shown by a number of these websites and apps suggested little regard for how anyone’s personal information should be handled, let alone that of children”
According to the investigation, 31% of these apps don’t have limits which can control the collection of user information, especially for under age users, which is alarming considering that “many organizations whose sites/apps were clearly popular with children simply claimed in their privacy notices that they were not intended for children, and then implemented no further controls to protect against the collection of personal data from the children who would inevitably access the app or site”.
Only 24% of the websites and applications analyzed promoted the involvement of parents in the activities that their children were taking part in. What’s more worrying is that 71% of the apps made it very difficult for the parent to eliminate any information that had previously been entered by the young user.
On the other end of the scale, the investigators discovered some tools that help put in place certain controls and allow for safe use, including parental control, predefined user avatars (which removes the temptation to upload names or photos), warnings that appears when an underage user tries to enter private information, and chat rooms that monitor the language being used.
This isn’t the first time we have seen a debate about the online privacy of minors. Apps related to toys are also under the spotlight and the Federal Trade Commission of the USA, one of the members of the GPEN, drew attention in 2012 to the fact that apps for infants collected information and shared it with third-parties.
More recently, Apple and Google had to pay out millions of dollars to this organization after allowing underage users to carry out purchases in their online stores over a period of years, all without requiring parental consent.
It is becoming more and more important to be vigilant of what your kids are downloading and what they are doing when they enter into these apps. You can start by taking a look at these security recommendations which will help you ensure that there are no nasty surprises later down the line.
The post 67% of apps for infants are gathering and storing private information appeared first on MediaCenter Panda Security.
Flowdock API Bug Bounty #2 – Persistent Web Vulnerability
Posted by Vulnerability Lab on Sep 24
Document Title:
===============
Flowdock API Bug Bounty #2 – Persistent Web Vulnerability
References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1572
Release Date:
=============
2015-09-23
Vulnerability Laboratory ID (VL-ID):
====================================
1572
Common Vulnerability Scoring System:
====================================
3.8
Product & Service Introduction:…
Self-driving cars – who is really in control?
Self-driving cars got a boost earlier this month from Toyota, which committed $50 million dollars to Stanford University and MIT for artificial intelligence and driverless car labs.
Unlike others in the race to put a driverless car on the road, Toyota has said its approach is not to build a fully autonomous car, but to provide “semi-autonomous assists” that will keep the driver in ultimate control.
At the Toyota announcement event, Re/Code reported that MIT’s Artificial Intelligence lab director Daniela Rus suggested artificial intelligence (AI) could, for example, enable a car to analyze your behaviour to assist in your driving and make it safer. She also described how AI features could make driving more pleasurable. For instance, if you were in a bad mood, it would begin playing your favorite music.
Meanwhile, a fascinating new book by the Pulitzer Prize-winning New York Times senior science writer and long-time tech reporter John Markoff, called “Machines of Loving Grace”, offers an exploration of the future of what smart machines can do for us and what they can help us do. The book, which is subtitled “The Quest for Common Ground Between Humans and Robots,” is an excellent primer on the topic of AI and autonomous cars. The question central to Markoff’s exploration is: Will we control these smart machines, or will they control us? (You can listen to an interview with Markoff on his book and the topic of AI and driverless cars that aired on National Public Radio).
Now is a good time to consider the question while driverless-car and other AI-driven technologies are still in early stages of development.
Most experts and insiders involved believe, for example, that it’s a five-year scenario before autonomous cars become a reality. However, in the meantime, we will continue to see more aspects of AI and the Internet of Things (IoT) impacting our daily lives, in and out of the car.
One example playing out right now is how major auto insurance companies are embracing and using the IoT to monitor vehicles and collect data on drivers’ habits and track their behaviour. This includes things like changes in speed, how often we drive, and the time of day we drive, etc.
In a new report, research by Business Intelligence estimates that there are 155 million cars on the road in the U.S. capable of being monitored today through On Board Diagnostic (OBD-II) dongles, or plugs, that sends analytics about the driver’s driving habits back to the insurance company. The purpose touted is that insurance firms can then offer clients potentially lower premiums based on the driving data and their ability to analyze and assess a clients’ risk levels. That’s certainly an incentive to drive well, but raises some concerns.
As Accenture analyst Mark Halverson points out in a recent article on the topic: “Big data is a boon for insurers, which use it for underwriting, pricing and more. For consumers, however, it’s more of a mixed blessing, as they sometimes fail to see the benefit of sacrificing privacy for convenience (to the extent they even know they are sacrificing privacy).”
If you are one of the hundreds of millions of people in the U.S. driving with OBD-II, do you know if your insurance company is monitoring your data?
Halverson argues that for the industry to provide a model of “purposeful” data collection and urges, “insurers should at the very least clearly state their purposes for collecting data, and ensure that the data will be handled securely.”
Ultimately, there are many questions to be answered about who will be in control of the drivers seat in the not too distant future.
3097966 – Inadvertently Disclosed Digital Certificates Could Allow Spoofing – Version: 1.0
Revision Note: V1.0 (September 24, 2015): Advisory published.
Summary: Microsoft is aware of four digital certificates that were inadvertently disclosed by D-Link Corporation that could be used in attempts to spoof content. The disclosed end-entity certificates cannot be used to issue other certificates or impersonate other domains, but could be used to sign code. This issue affects all supported releases of Microsoft Windows.