When Will Our Data Be Secure?

As CES gets underway, it’s even more apparent that 2016 is projected to be the year of the “reluctant sharer”. The overwhelming common denominator of the conference seems to be cybersecurity, whether regarding drones, autonomous sport cars, or wearables; practically every device announced at CES has some type of Internet connection, adding to the already-reluctant sharer’s worries.

The latest MEF Global Consumer Trust Report 2016, in partnership with AVG, addresses digital citizenship – consumers’ responsibility to secure their online data and privacy. As an industry, are we sufficiently holding up our end of the deal, our responsibility to the consumers? One of the most striking findings in this year’s report, is the rise of the “reluctant sharer,” a growing 41% who don’t want to give up their personal information but know they need to in order to use an app. While consumers recognize more than ever how vital it is to protect themselves online, they feel caught. In just a single year, 20% more consumers shared personal information they would rather not have, just to be able to use apps and services.

With innovation in the connected world happening at an incredible pace, is resignation really the feeling we want customers to have at the beginning of our relationship with them? Year over year, this report has revealed a decrease in consumer trust, and in 2015, more people than ever (36%) said that lack of trust is the number one reason they decided against using software or apps. As an industry we can do better.

We needn’t look far to see how this might play out. Consumer distrust, leading to complete intolerance, has irrevocably disrupted the business model of digital publishing, in regards to ad blockers. While controversy surrounding the phenomenon is nothing new, Apple’s recent decision to allow ad-blocking apps has tipped the issue into mainstream consciousness and forced an entire industry to re-evaluate how it operates; and, perhaps most important, the value it offers to the people who make it all possible: their readers (consumers).

I predict that as high-profile hacks, like those on Talk Talk, Ashley Madison, the US Office of Personnel Management, and even the FBI, continue to dominate mainstream media conversations, fewer and fewer consumers will be willing to take this ‘devil’s bargain’ of privacy in exchange for services. And who can blame them? In fact, nearly half (47%) of everyone surveyed for this year’s report said they’d be willing to pay for an app that guaranteed not to share any collected data. That number is surely on the rise as consumers at large become more aware of the risks.

Given all this, I think the real question is not whether 2016 will signal a tipping point for consumers, but whether it will be the tipping point for us, the industry.

We, in mobile, have to decide if we want more than simply to avoid digital publishing’s troubles. We must put our customers first, and go beyond being only “good enough” at protecting them. Transparency and education need to go hand-in-hand with an industry-wide commitment to set, adhere to, and hold each other accountable for honorable, human-centered behavior principles. It is no longer enough to show consumers the “what” of data collection and sharing—we need to explain the purpose and consumer benefit of doing so, without spin, in real-life terms.

Who will step up to the challenge?

Ultimately, people should not have to trade privacy and security to benefit from the wealth of data-enabled services that are available now and on the horizon. Our customers are speaking loud and clear. Will we listen?

USN-2861-1: libpng vulnerabilities

Ubuntu Security Notice USN-2861-1

6th January, 2016

libpng vulnerabilities

A security issue affects these releases of Ubuntu and its
derivatives:

  • Ubuntu 15.10
  • Ubuntu 15.04
  • Ubuntu 14.04 LTS
  • Ubuntu 12.04 LTS

Summary

libpng could be made to crash or run programs as your login if it opened a
specially crafted file.

Software description

  • libpng
    – PNG (Portable Network Graphics) file library

Details

It was discovered that libpng incorrectly handled certain small bit-depth
values. If a user or automated system using libpng were tricked into
opening a specially crafted image, an attacker could exploit this to cause
a denial of service or execute code with the privileges of the user
invoking the program. (CVE-2015-8472)

Qixue Xiao and Chen Yu discovered that libpng incorrectly handled certain
malformed images. If a user or automated system using libpng were tricked
into opening a specially crafted image, an attacker could exploit this to
cause a denial of service. (CVE-2015-8540)

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 15.10:
libpng12-0

1.2.51-0ubuntu3.15.10.2
Ubuntu 15.04:
libpng12-0

1.2.51-0ubuntu3.15.04.2
Ubuntu 14.04 LTS:
libpng12-0

1.2.50-1ubuntu2.14.04.2
Ubuntu 12.04 LTS:
libpng12-0

1.2.46-3ubuntu4.2

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to restart your session to make
all the necessary changes.

References

CVE-2015-8472,

CVE-2015-8540

Ubuntu Security Notice USN-2861-1

Ubuntu Security Notice 2861-1 – It was discovered that libpng incorrectly handled certain small bit-depth values. If a user or automated system using libpng were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or execute code with the privileges of the user invoking the program. Qixue Xiao and Chen Yu discovered that libpng incorrectly handled certain malformed images. If a user or automated system using libpng were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service. Various other issues were also addressed.