Category Archives: ESET

ESET

ESET

IFA 2014: Huawei phablet has ‘iPhone-like’ fingerprint ID

Another major phone brand has added biometric security to a flagship smartphone as Huawei unveiled the ultra-thin Mate P7, complete with a rather unique fingerprint scanner,  at Berlin’s IFA 2014 show.

The ultra-slim 6-inch phablet device uses an interesting biometric scanner – just like TouchID on the iPhone 5S, the user simply places a digit on the scanner, according to Tech Radar’s report.

This marks it out from the scanners found on the Samsung Galaxy S5 and HTC One Max, where the user has to swipe a digit over the scanner in a certain direction according to Digital Trends.

IFA 2014: Unique ‘iPhone-like’ scanner

Huawei is the largest telecoms equipment maker in the world. Biometrics has been one of the big tech trends for 2014, with devices as diverse as an iris-scanning smartwatch and earbuds which ‘read’ a wearer’s heartbeat using flashes of light in development, as reported by We Live Security.

Fingerprint scanners – and other biometric scans – have been predicted as “likely to become commonplace” in smartphones by MIT’s Technology Review.

Pocket-Lint says that the Ascend Mate P7 is a high-end handset with a polished metal finish just like the iPhone 5S, and a high-quality forward-facing 5-megapixel camera for “selfies.”

Digital Trends says, “Most importantly though, the Mate 7 has a fingerprint scanner that works exactly like the one on the iPhone 5S. Instead of having to swipe your finger across it like you do with Samsung’s Galaxy S5, you can simply place your digit on the scanner to unlock your phone and perform other tasks. The fingerprint sensor is located on the back of the phone below the camera.”

No swiping required

The early part of this week has seen companies such as Samsung unveil new gadgets at IFA 2014 – but the show floor proper will open tomorrow, with more biometric gadgets expected. Read the report on We Live Security this week.

Smartphones are increasingly being used both in the home and the workplace as a security measure in their own right, with mobile workers accessing networks via “two factor authentication” software such as ESET Secure Authentication.

Adding fingerprint security to the handsets provides another layer of security for data.

The post IFA 2014: Huawei phablet has ‘iPhone-like’ fingerprint ID appeared first on We Live Security.

ESET

YouTube scam warning after fake “suspension” emails strike users

A YouTube scam where users are threatened with suspension for an unspecified “violation” of the video site’s guidelines has been circulating via email, according to Softpedia’s report.

The phishing YouTube scam is common enough to be causing users to raise questions on Google Groups, according to the site’s report.

The YouTube scam email reads, “We’d like to inform you that due to repeated or severe violations of our community guidelines and your YouTube account will be suspended 3 days from the time of this message.”

YouTube scam: Trap leads to surveys

This form of scam is more common on Facebook, Softpedia notes. Other We Live Security reports describe such typical Facebook scams. As with Facebook, it’s likely that multiple variants of the scam email are circulating, so the text may vary.

The particular variant seen by Softpedia continues, “After careful review we determined that activity in your account violated our community guidelines, which prohibit spam, scams or commercially deceptive content.

“Please be aware that you are prohibited from accessing, possessing or creating any other YouTube accounts.”

YouTube scams: What to do

ESET security specialist Mark James says, “The problem with phishing emails is that it’s their job to trick you into thinking they are legit, often using the same graphics or templates from legitimate emails from real companies.”

“The methods they use include rewards for following links, penalties for not taking action and sometimes topics that offend easily forcing you not to take advice for fear of being judged or even prosecuted.”

In this case, Softpedia says, the link in the emails directs the users to a series of surveys, some of which ask for the user’s phone number – which can lead to further SMS scams.

James says, “There are many ways to spot these false emails, firstly, most companies will have layers of procedures before sending out emails (especially intent of termination emails) that are proofread and checked over again before being sent, also look to see who its written to, if it is about a service that’s going to be cancelled then it SHOULD be directed to YOU not “Dear customer” or “Dear user”. They want your business and its important for you to feel your important.

“Check the sending email address. Don’t be fooled by the company name if it appears in the address, look to see if it looks right, most organizations want you to remember their details, so a long winded email address from PayPal with “pay” and “pal” in there somewhere won’t be from them, look for unrealistic threats – if it’s going to happen in 24 hours, or some other short time period, chances are it’s fake.”

“DON’T open any attachments regardless of how enticing they seem, if you need to fill a form out to continue the service you are okay to call the company and ask them to mail the form to you, at that point you can verify if it is legitimate. DON’T follow any links, if the email has a link then check to see not only what it says but move your mouse over it and see WHERE it goes.”

A detailed We Live Security guide to the latest phishing scams (and how to avoid them) can be found here.

The post YouTube scam warning after fake “suspension” emails strike users appeared first on We Live Security.

ESET

Car hacking – are one-third of thefts ‘electronic hacks’?

The UK government is to work with car manufacturers to prevent hackers using electronic means to break into increasingly hi-tech vehicles in Britain, after a spate of ‘car hacking’ in London, Computer World reports.

In a speech to independent think tank Reform, Home Secretary Theresa May said that thieves were using “sophisticated devices” to grab car key codes, and driving away in less than 10 seconds without using force, according to the Daily Mail.

The report claimed that “hackers” were behind a third of card thefts in London.

At the Black Hat security conference this summer two researchers launched a petition to change how car companies and technology companies work together. “We request that you unite with us in a joint commitment to safety between the automotive and cyber security industries,” the researchers said via Change.org.

Car hacking: A real risk?

In her speech to Reform, May said, “There have been reports that they could even use ‘malware’ to commandeer vehicle systems via satellites and issue remote demands to unlock doors, disable alarms and start car engines.”

“Because we have this understanding, we can now work with industry to improve electronic resilience, include this kind of resilience in the vehicle’s overall security ratings, and work out the extent to which the same threat applies to other physical assets such as building security systems.”

May’s speech echoes a series of presentations by security researchers which warn that as cars become increasingly ‘connected’, with up to 200 control units each, hacking such vehicles becomes easy.

Two researchers have concluded that this will become even easier once web browsers in cars become more common.

Hackers behind ‘third’ of crimes

Earlier this summer, a group of Chinese researchers showed off a hack which could open the doors on a Tesla S while in motion, as well as controlling other vehicle systems – and the car’s control panel, thought to run a modified version of Firefox, was claimed to be behind the hack.

Charlie Miller and Chris Valasek in their paper A Survey of Remote Automotive Attack Surfaces conclude that the danger of “hackable” cars is expanding – but is about to grow rapidly, as web browsers are added to cars.

“Once you add a web browser to a car, it’s open. I may not be able to write a Bluetooth exploit, but I know I can exploit web browsers.”

Last year a U.S senator urged auto manufacturers to change – and his open letter ignited a spate of commentary, with Market Oracle describing the crime as “cyberjacking”, and pointing out that the average family car contains 100 million lines of computer code, and that software can account for up to 40% of the cost of the vehicle, according to researchers at the University of Wisconsin-Madison.

On the researchers’ page, I am the Cavalry, they say, “Modern cars are computers on wheels and are increasingly connected and controlled by software. Dependence on technology in vehicles has grown faster than effective means to secure it.”

 

The post Car hacking – are one-third of thefts ‘electronic hacks’? appeared first on We Live Security.

ESET

Credit card security fears – could Home Depot breach be biggest yet?

Shoppers at Home Depot stores may have had their credit card security details leaked online, after a massive batch of card information went on sale on a criminal internet site this week, according to veteran security writer Brian Krebs, who reported the possible breach on his Krebs on Security website. Krebs claims the breach may be the biggest yet seen.

The credit card security breach could have begun as early as April or early May of this year, and may be linked to hackers responsible for the breaches at Target and P.F. Changs, according to Krebs. Separate batches of debit and credit card details from European and American shoppers have been offered for sale on a criminal website this week.

U.S.A. Today reports that the breach could dwarf even the Target Breach, in which 40 million debit and credit accounts were compromised.

Fox Business News reported that Home Depot has, as yet, not confirmed the scale of the breach.

Credit card security: The biggest breach yet?

“Protecting our customers’ information is something we take extremely seriously, and we are aggressively gathering facts at this point while working to protect customers. If we confirm that a breach has occurred, we will make sure customers are notified immediately,” spokesperson Paula Drake said in a statement.

The card data were offered for sale under the title, “American Sanctions,” which Krebs interpreted as related to the ongoing conflict in the Ukraine. Stolen information from European cards which had been used in the stores were sold separately as “European Sanctions,” Krebs reported.

Home Depot shares dropped 2.6% at the news, Fox Business reported.

Krebs’ spoke to several banks, and his latest update hints that this breach could be the biggest yet seen. “Several banks contacted by this reporter said they believe this breach may extend back to late April or early May 2014. If that is accurate — and if even a majority of Home Depot stores were compromised — this breach could be many times larger than Target, which had 40 million credit and debit cards stolen over a three-week period,” he says.

Mark James, security specialist at ESET says, “The news of another credit card hack is not surprising – but is no less worrying. It seems that no company is safe and if you have EVER used a credit card to purchase goods then you may be at risk.”

“It is thought the original team that targeted P.F.Chang’s and Target are also the perpetrators here, and due to the amount of data that has been stolen it stands to reason it will be used or released in batches over time.”

Card breach: What to do

ESET Malware Researcher Lysa Myers says, “Malware attacks on Point of Sale (PoS) systems are coming thick and fast right now.”

Myers offers a detailed guide for businesses concerned that they may be being targeted with POS malware.

ESET’s James says, “Nothing can be done about the data already stolen, but we could take some actions to lessen the impact of compromised credit cards. Don’t just have a single credit for all uses: for instance, separate your physical purchases (in store) and your online purchases by using different credit cards for each.”

“At least that way if one gets lost or stolen it’s not so much of an impact to get it stopped and replaced, also it’s always good practice to keep an eye on your credit statement for small or unusual payments, often small (under the radar) amounts are processed to test if the cards are valid. If they go through then larger amounts will follow.”

“If you spot something unusual notify your bank immediately. As always, it’s imperative the organization in question notifies all parties involved in any security breach so we the public can take action quickly.”

The post Credit card security fears – could Home Depot breach be biggest yet? appeared first on We Live Security.

ESET

Secure password: CyberVor hoard of 1.2 billion details ‘used in attack’

Hosting provider Namecheap has come under attack from hackers apparently using the “CyberVor” hoard of 1.2 billion usernames and passwords, and has warned that some accounts that had failed to use a secure password may have been compromised.

In a blog post entitled, “Urgent Security Warning”, the company said that some accounts had been compromised, but Computer World reports that the “vast majority” of login attempts had failed.

Namecheap said that it was now “aggressively blocking” the IP addresses that the attack appeared to have come from, and said that the logins appeared to come from the record-breaking hoard of passwords and usernames stolen by the gang known as “CyberVor”.

Secure password: Record-breaking hoard used in attack

Veteran security writer and researcher, and We Live Security contributor Graham Cluley said, “The gang, which has been dubbed “CyberVor” (“vor” means “thief” in Russian) by security researchers, is thought to be in possession of the largest known haul of stolen internet credentials – 1.2 billion usernames and passwords, together with 542 million email addresses. And the data has been stolen from some 420,000 different websites.”

Company officials did not reveal why they suspected the credentials being used in the attack were the ones from the Cybervor (“Vor” is Russian for “thief”) trove which was discovered online last month, with a mix of passwords, usernames and email addressses in one online cache, according to CIO magazine.

“Overnight, our intrusion detection systems alerted us to a much higher than normal load against our login systems. Upon investigation, we determined that the username and password data gathered from third party sites, likely the data identified by The Register (i.e. not Namecheap) is being used to try and gain access to Namecheap.com accounts,” Namecheap said, also offering advice for users on how to create a secure password for their accounts.

Fake browser used in mass attack

“The group behind this is using the stored usernames and passwords to simulate a web browser login through fake browser software. This software simulates the actual login process a user would use if they are using Firefox/Safari/Chrome to access their Namecheap account. The hackers are going through their username/password list and trying each and every one to try and get into Namecheap user accounts,” Namecheap said.

Veteran security writer and researcher, and We Live Security contributor Graham Cluley advises, “Whenever you create accounts online you are putting trust in the hands of web developers that they are properly securing your information. The very best you can do is enable additional security measures (such as multi-factor authentication when made available), and ensure that you never reuse the same password nor choose a password that is easy to guess or crack.

“Because one thing is clear: The Russian CyberVor gang may or may not be sitting on one of the largest cybercriminal hauls in history, but unless we all work harder to keep our private information safe and secure, this is not going to be the last time that you’re waking up to newspaper headlines of stolen passwords.”

 

 

 

The post Secure password: CyberVor hoard of 1.2 billion details ‘used in attack’ appeared first on We Live Security.

ESET

Cybercrime: Top experts to form international crook-hunting force

As many as 18 top cybercrime experts from around the world will form a new Joint Cybercrime Action Task Force based in the Hague, which will target “top-level criminals” far faster than any previous force, the Guardian reports. The Joint Cybercrime Action Task Force (J-CAT) said that the new entity would allow action against high-profile criminals to move more quickly than before, “It’s not a talk shop. This has to lead to more arrests,” said  Troels Oerting, head of Europol’s European Cybercrime Center, according to V3’s report. The unit will be headed by Britain’s Andy Archibald, head of the National Cyber Crime Unit,  according to The Parliament Magazine.

Cybercrime: “This will lead to more arrests”

“The J-CAT will operate from secure offices in Europol’s HQ, assisted by experts and analysts from the EC3. The aim is not purely strategic, but also very operational. The goal is to prevent cyber crime, to disrupt it, catch crooks and seize their illegal profits,” said Troels Oerting, head of Europol’s European Cybercrime Center, according to V3. “This is a first step in a long walk towards an open, transparent, free but also safe internet. The goal cannot be reached by law enforcement alone, but will require a consolidated effort from many stakeholders in our global village. But the J-CAT will do its part of the necessary ‘heavy lifting’ and that work started today. I am confident we will see practical tangible results very soon.” The Guardian pointed to some of the difficulties facing such organizations – such as the fact that criminals such as Evgeniy Bogachev remain at large, despite being accused of major cybercrimes.

“The goal is to prevent cybercrime”

Archibald, who will head the new organization, organized a major international operation to attack the command and control servers of the notorious banking malware Shylock/Win32/Caphaw. He says that cross-border cooperation is key to success against today’s cyber gangs. The new J-CAT organization will also deal with private-sector companies and computer-emergency teams from other EU organizations to ensure effective information sharing. Mr Archibald said: “There are many challenges faced by law enforcement agencies with regards to cyber criminals and cyber attacks. This is why there needs to be a truly holistic and collaborative approach taken when tackling them.” “The J-CAT will, for the first time, bring together a coalition of countries across Europe and beyond to coordinate the operational response to the common current and emerging global cyber threats faced by J-CAT members.” “This is a unique opportunity for international law enforcement agencies to collectively share our knowledge to defend against cyber related attacks, and the UK’s National Crime Agency is proud to be a founding member”.

The post Cybercrime: Top experts to form international crook-hunting force appeared first on We Live Security.

ESET

Wi-Fi password – “one second” hack allows attackers into many routers

A push-button function on many wireless routers designed to bypass the Wi-Fi password and provide quick access to the network could allow attackers to break in in just “one second”, reports have claimed. The Wi-Fi password flaw was found by Swiss security firm Oxcite, and allows hackers to bypass the security of Wi-Fi Protected Setup almost instantly, according to Engadget’s report. Rather than making thousands of guesses at the PIN code, the attackers make one guess, based on offline calculations. “It takes one second,” Dominique Brongard of Oxcite said. “It’s nothing. Bang. Done.”

Wi-Fi password: “It takes one second”

The attack is the latest in a series of weaknesses uncovered in popular models of routers – and affects routers using a chipset made by Broadcom and another , as yet unnamed, manufacturer. In both cases Oxcite claims, it would take roughly “one second” to guess the hotspot’s PIN code. The attack relies on poorly generated “random” numbers, and is not inherent to WPS itself, just the (as yet undisclosed) router models. The researchers believe, however, that the Wi-Fi password security flaw is relatively common, and advise users to switch off the WPS function (done from any router’s set-up page) until the problem is known to be solved. Research has shown that many popular router models ship with known Wi-Fi password vulnerabilities among others, which activist group Electronic Frontier Foundation attributes to the relatively low price of the devices, and the difficulty of budgeting for proper security updates. A We Live Security guide to keeping small-office and home routers as secure as possible can be found here.

“It’s nothing. Bang. Done.”

The Wi-Fi alliance said, speaking to Ars Technica, “A vendor implementation that improperly generates random numbers is more susceptible to attack, and it appears as though this is the case with at least two devices.” “It is likely that the issue lies in the specific vendor implementations rather than the technology itself. As the published research does not identify specific products, we do not know whether any Wi-Fi certified devices are affected, and we are unable to confirm the findings.”

The post Wi-Fi password – “one second” hack allows attackers into many routers appeared first on We Live Security.

ESET

Week in Security: Game over in Korea, cellphone snoops and phishy Bitcoins

Gamers and cellphone users were targeted by criminal groups around the world in our security news this week – with results varying from slightly eerie surveillance towers, to a gigantic data breach in which 220 million records were traded. The former were struck with a series of irritating service outages caused by a hacktivist group, plus a data breach of enormous proportions, which swept up half of South Korea’s population in a scam designed to steal virtual money and goods.

Cellphone users were left looking over their shoulders as a security news report highlighted the sale and use of tools which could track a user with high accuracy from town to town and even to other countries – and these tools are being bought not only by oppressive regimes, but by gangs.

Even more disconcerting was the discovery of at least 17 ‘fake’ cellphone towers which hacked into nearby handsets to either eavesdrop, or install spyware. The fake towers, found, oddly enough, by a company which markets handsets immune to such attacks, were found throughout America – with one, puzzlingly, in a casino….

Meanwhile, POS malware continues to multiply, and a new phishing attack highlighted how social engineering can strike anyone…

Security news: Half of South Korea breached

By anyone’s standards, it was a massive data breach – involving 27 million people, half the population, and 220 million private records changing hands. It also highlighted just how much South Korea loves playing games, as it hit adults and children alike – the breach targeted registration pages and passwords for six online gaming sites, with the aim of selling game currency and virtual goods.

The breach affected 70% of the population between the ages of 15 and 65, according to Forbes.

The sixteen hackers who were jailed had used 220 million items of personally identifying information, with the goal of breaking into online game accounts. A 24-year-old man, surname Kim, bought these records from a Chinese hacker he met in another online game in 2011, according to the Korea JoonGang Daily.

Kim and his associates are thought to have used a hacking tool known as an “extractor” to log in to accounts and steal virtual currency to and items to sell – earning in the process 400 million won ($390,919).

1,000 U.S. firms infected with credit-card-stealing POS malware

An official warning issued this week highlighted the rise and rise of malware targeting point-of-sale systems in retail outlets, with the goal of stealing credit card details – with Secret Service operatives warning that one particular strain had infected a vast number of American firms.

The United States Computer Emergency Readiness Team issued a statement saying that the “Backoff” malware was rife in U.S. businesses, taking over administrator accounts and removing customer data from several hundreds of companies. Their information was based on Secret Service estimates, after conversations with POS software vendors in America.

ESET Malware Researcher Lysa Myers says, “Malware attacks on Point of Sale (PoS) systems are coming thick and fast right now.”

Myers offers a detailed guide for businesses concerned that they may be being targeted with POS malware.

Cellphone users targeted by cyber-snoops

Cellphone users, you may be being watched – by a surveillance industry which one privacy group claims is worth $5 million a year.  This week saw an in-depth report into the export of equipment  which can track the movements of anyone carrying a cellphone – from town to town and even into other countries.

It also saw the discovery of “fake” cellphone towers known as “interceptors” in active use on U.S. soil, according to Popular Science. The technology is known, but expensive, and it’s unclear who is operating the towers, or why.

High-end surveillance technologies which penetrate networks to track users are freely on sale not only to oppressive regimes, but also to criminal gangs, according to a report by the Washington Post.

Third-party surveillance apps are, of course, widely available which allow suspicious spouses and more nefarious individuals to track the owner of a phone by surreptitiously installing and hiding such an app. Such ‘domestic spyware’ is often involved in domestic violence cases.

The gear used by oppressive regimes is of a higher level altogether. “Surveillance systems are secretly collecting these records to map people’s travels over days, weeks or longer, according to company marketing documents and experts in surveillance technology,” the Washington Post reports.

“The capabilities of surveillance technology have grown hugely in the past decade – in the hands of a repressive regime, this equipment eradicates free speech, quashes dissent and places dissidents at the mercy of ruling powers as effectively as guns and bombs, if not more so,” Privacy International says in its report.

Game Over, man! PSN taken down, other networks under attack

A new hacktivist gang disrupted and brought down several gaming services this week, including Sony’s PSN network, and the Twitch gamer-TV service, which returned only after presenters Tweeted photographs of themselves with the group’s name written on their foreheads.

Most of the attacks were basic denial-of-service attacks, and no information was lost during Sony’s network outage. The FBI took an interest when a reported bomb threat by the same group caused the diversion of a flight carrying a Sony executive, according to Reuters report.

Sony summed up in a blog post, “The networks were taken offline due to a distributed denial of service attack. We have seen no evidence of any intrusion to the network and no evidence of any unauthorized access to users’ personal information.”

It is as yet unclear what the group’s motivation is – with DDoS attacks also aimed at popular PC titles such as Blizzard’s Battle.net, Riot’s League of Legends and Grinding Gear Games’ Path of Exile.

Bitcoin phishing a cryptic success with non-users

How hot is Bitcoin right now? So hot that even non-Bitcoin users are tempted to click on phishing links referring to Bitcoin wallet sites (which they don’t use). The relative success of the attacks shows how social engineering can take many forms – and that clicking on links in ANY unsolicited email is a bad idea.

Previous Bitcoin wallet phishing campaigns usually targeted known lists of Bitcoin users. The new waves of phishing emails were targeted at corporations, rather than those with an interest in cryptocurrency. The tactic has proved a success for the criminals behind it – with nearly 2.7% of victims clicking on the malicious link embedded in the two waves of 12,000 emails.

Proofpoint, which monitored the attack, said that the high success rate proved how much the hype behind the Bitcoin wallet had caught the imagination of the general population.“Unregulated and designed for anonymity, Bitcoin represents an attractive, $6.8 billion target to cyber criminals,” Proofpoint said.

The Register’s John Leyden reported, “This high click-through rate is a concern because crooks could easily switch from Bitcoin scams to targeting curious users with DDoS malware, remote access Trojans, corporate credential phish, or other threats.”

Some things, of course, don’t change: the emails took the form of a classic “account warning” phishing email, just using a Bitcoin site instead of a bank.

The post Week in Security: Game over in Korea, cellphone snoops and phishy Bitcoins appeared first on We Live Security.

ESET

Internet privacy: Seven rules to keep secrets safe

Internet privacy is something consumers are increasingly aware of, but which is near-impossible to achieve. You are never truly invisible on the internet – just witness how quickly the Blackphone, made by encryption legends Silent Circle met its match at DEF CON.

But while the free internet relies on “watching you” to sell ads, and others watch you just because they like it, there are a few steps sensible internet users should take for those moments when a little internet privacy IS required.

Most are the basics of internet privacy - password hygiene – and good security practice on social networks.

But when it comes to things you might want to keep private – business conversations that would be of interest to a rival, hobbies such as motorcycling that might be of interest to an insurer, a few basic steps can help.

If you ARE James Bond, no security tip in the world will stop your enemies watching you – that’s their job. For most of us – from college students to small businesses to people afraid of one particular watcher, such as domestic violence survivors – some basic steps will help you stay private.

Tinfoil hats are not required. Nor is switching to a “private” browser such as Tor – although privacy-conscious users may find it surprisingly fast these days.

Rule one: Use the internet privacy tools provided by ‘the watchers’

There are good reasons to revisit the internet privacy menus on your Facebook account – and it’s highly unwise to post anything to the network that is in any way sensitive. Facebook  is not content with the trove of data provided by its own users – it deals with third-party “data broker” companies, who provide the company with encrypted lists of email addresses (for instance, of users who have bought a vacuum cleaner), which Facebook then matches against its own encrypted list. This means the company may ‘know’ more than you think it does. The only defense is to be cautious with data both inside and outside Facebook.

There are other good reasons behind people’s distrust of Facebook, and to ensure your account is locked up as much as possible. This year, the social site added hidden tracking in its ubiquitous ‘Like’ button to track users outside of Facebook pages. The new tracking method actually ignores users’ Do Not Track preference settings (the browser setting where users can choose “ask websites to not track me”). Staying logged out as much as possible is a good idea to increase your internet privacy.

Google is a major player in collecting data – every Google service from YouTube to Search collects information on signed-in users, and collates it to refer to one user profile. This is used to tailor Google ‘adwords’ – the text adverts that appear around searches and above Gmail’s Inbox – to the user. Google, however, is very open about how it all works, and you can opt out of almost everything, even if you’re a heavy user. If you do so, the only service you’ll really be unable to use is the excellent Google Now on Android, which relies heavily on search history and location history. It poses its own privacy risks, of course, if anyone looks over your shoulder…

Google itself offers a clear explanation of how its data collection works – and provides a dashboard of tools web users may wish to use to prevent themselves being tracked. For Google, personalized adverts are a service, and one you can choose not to use. Facebook’s approach is more opaque. Facebook said that it would also ignore “do not track” signals sent by browsers – a measure put in place to offer users choice on privacy – because “because currently there is no industry consensus.”

Rule two: Don’t tell the internet your age, or if you went to college

Sharing information too openly online is a bad idea – leaving you open to spear phishing attacks. But data also falls into the hands of companies which trade in it – billions of data points at once, sold to advertisers and other companies. Most of these are perfectly normal companies. Some are not. The Federal Trade Commission is investigating ‘data brokers’. The industry is thus far largely unregulated, and brokers will offer anything from anonymous data gleaned from browsing, to a mix of data, some publicly available, some from website cookies and other tracking tools. You are significantly more likely to be identifiable from your data if you share things publicly – even the fact you own a dog, or your address, or if you geolocate pictures. Take control of this data. Don’t share when you don’t have to.

internet privacy

Consumers are increasingly concerned about privacy, a Silent Circle poll found

Social networks are a prime example, but “overfilling” a profile on a blog or corporate site can also reveal details. If there’s ever a box about sharing data with other companies, make sure you tick (or don’t tick) so your data isn’t shared. Whatever happens to it, it isn’t going away. Some, not all data brokers categorise customers in a way which may impact future eligibility for financial products – categorising them as uneducated, or putting them in a category of older people, or instance. This is information you should not share publicly, as it may impact your financial future.

Rule Three: Don’t trust ‘Do Not Track’ – Incognito or Private mode are better

Many companies ignore a browser’s request not to be tracked – including high profile firms such as Facebook.  The only fix is to use Incognito or Private browsing, and not log in to Facebook as you browse.

You will still be followed by trackers (cookies and scripts embedded in most websites) as you browse, but the profile that’s built up applies to a user who disappears when the session ends. You are still, of course, not truly ‘private’ – your IP address can still be traced as having visited a particular website, but it helps. Setting your browser to delete cookies on closing also helps in this regard – but it’s not a silver bullet.

Rule Four: Don’t use Facebook log-ins on apps

Don’t imagine smartphones are any different from PCs – you will be tracked on your browser, just as you are on PC, and there are other security concerns, too. But one step is easy to take. Many apps allow users to log in using their Facebook details, which spares user the time of filling in a form.

internet privacy

However, this allows the social network to use information from the app, and apply this to its advertising profile to target adverts. Any information in the app becomes available to Facebook. If you’re worried about how much Facebook ‘knows’ about you, use email to log in instead.

Rule Five: Turn to Tails if you  really need to be private

If you are determined not to be watched, Tails is a high-end internet privacy tool – although it should be noted that it is not “spy proof”. It boots from a DVD or USB stick, and forces internet traffic through the anonymizing service Tor (all non-Tor connections are rejected). Tor is of course not immune from spying – but it’s as secure as it gets, most of the time.

When you’ve finished, Tails deletes all data from the session (it’s stored in RAM rather than in computer storage). It can be used on any computer, and leaves no trace once the session ends. You are, of course, still vulnerable to some techniques – for instance, electronic listening devices could pick up your keystrokes.

Rule Six: If you’re doing business, use a VPN, and encrypt everything you can

If you are using the internet for sensitive business reasons, use VPN software. Either provided by your company, or if you’re a small business or freelancer, use your own VPN client. Likewise, ensure you encrypt as much as you can – from emails to data stored on your PC. ESET researcher Stephen Cobb argues that encryption is now essential for business – and with the rate of data breaches seen over the past few months it’s hard to argue. Malware researcher Lysa Myers says,”The best way to protect your data from prying eyes is to make more of it unreadable to outside parties. And the best way to do this is to encrypt as much as you can both data that is saved on your hard disk, and data that you send out of your machine, via email, web or other methods.”

Rule Seven: You are never invisible online

No matter how paranoid you are, how security-conscious you are, there is always a way round your snoop-proof techniques. Unscrupulous and greedy people will find it. If you want something to stay private, don’t do it online, or on the phone. Do it in the real world. As more consumers use internet privacy tools, new unknown techniques appear to bypass them. ‘Canvas fingerprinting’ is a new technique, invisible to users, which became widespread among companies selling data to advertisers before the media were even aware of it. Requiring PCs to render a fragment of text, it bypasses “do not track” instructions to create a fingerprint which “shatters” current privacy tools, Princeton researchers say. One provider which uses the ‘fingerprinting’ technique,  touted as a replacement for cookies for advertisers keen to track users across the web, uses its scripts in thousands of sites – and reaches 97.2% of the internet population in America, according to Comscore.

The post Internet privacy: Seven rules to keep secrets safe appeared first on We Live Security.

ESET

Anyone want to know my Social Security Number?

Let me tell you about yet another brain-dead Facebook meme* about ‘your [something or other] name’ games. These games are the sort of round-robin post that tell you how to generate your very own witness protection name, your soap character name, and similar richly meaningful concepts.

It’s Only Rock and Roll

Apparently the rock star name meme has been around since at least 2007, but I somehow managed to miss it for most of that time. Clearly I should consider dedicating what is left of my twilight years to Facebook so that I don’t miss anything.

Perhaps this one has something to do with the way rock stars, footballers, and movie stars, worried that alternatively pampering and neglecting their offspring might not be the optimum parenting methodology, give them ludicrous names like Leafmould Cheesecake. Or I suppose it might be a way of generating a name that will get you mistaken for a celebrity and ensure that you get into nightclubs and pay a larger than normal deposit on hotel rooms. Anyway, most of the examples I’ve seen (thank you so much, Google, for brightening my life yet again) are generated by combining the name of your first pet and something like your current car, your first car, or the street where you live. (I apologize if I’ve increased the danger that some future reader will be christened Tiddley Widdley 2CV.)

Security content coming up. (Finally.)

It may not have escaped your notice that those elements are very similar to those secret questions that banks and such want us to use to supplement those passwords that they take such good care of. Sometimes. (Here’s a list of other name ‘games’, several of which have a disquieting tendency to be based on ‘secret question’ data.)

I started looking into this social phenomenon when I recently came across a variation on the rock star meme: this one offers us the following way to find our own rock star names. Ready, steady, type:

  1. Your mother’s maiden name
  2. Your first pet’s name
  3. The model of your first car
  4. Your High School mascot
  5. Your favourite uncle
  6. The last four digits of your Social Security Number (SSN)

Several of my friends in the security business found this meme extremely amusing. As you probably will too, knowing that this is a parody – or an extreme example – of the kind of ‘secret questions’ that financial providers and others are fond of passing off as additional security. In fact, the first three are common – even stereotypical – secret questions proposed by real service providers. 4 and 5, maybe not so much. But SSNs are commonly used in the US as authentication, so there’s certainly possible value there for someone trying to harvest useful information about you.

Still, surely no-one could fail to recognize the danger there? Well, some people who commented clearly thought it would be worth putting it out there to see who (or how many) fell for it, if only out of curiosity. No ethical qualms there, then.

Friendship and Fiendship

I’ve talked before (for Virus Bulletin) about the potential of the Facebook meme for collecting data that could be used for malicious purposes. One datum addressed there was your date of birth  (mildly obfuscated, but if I could find out how it worked, so could any bad guy who could use a search engine). Another was the instance cited by Graham Cluley of the Royal Wedding in 2011, inviting Facebook users to generate their ‘royal wedding guest name’ by combining an aristocratic title, one of their grandparent’s names, and the name of their first pet ‘double-barrelled’ with the name of the street they grew up on. I can assure you that if I absent-mindedly sign this article as Lord Melvin Sundance-Acacia, I won’t be giving any sensitive data away. After 25 years in security, I’m not naïve enough to think that everyone who’s a friend on social media – or a reader of my blogs – is to be trusted with personal data. I don’t think there are many burglars or identity thieves in my immediate circle of acquaintance, but friends of friends of friends are another matter. In any case, I’m pretty sure that some of my friends aren’t as paranoid with their – or my – posts and data as I am. Furthermore, I’m no fan of the way that various social networks try to insist on my giving them far more personal information than they really need to know.

Not, of course, that I’m advocating a general policy of dishonesty in social networking profiles, but as I commented in that article and elsewhere, these are organizations who regard subscribers not as customers but as sources of commoditized data. Big names in the social media are constant targets for hacking, and don’t always take the care over securing sensitive data that you might expect. In fact, they often have an agenda that is at heart anti-privacy, since our data is exactly what matters to the retail organizations and service providers who are their real customers. While we the subscribers are all too willing to give away the sort of material targeted in a data aggregation (or data inference) attack, where individual items may seem harmless, but an aggregation of such items gives an attacker all he needs to indulge in a little identity theft.

Social Insecurity

But let’s talk about SSNs. Is giving away just part of your SSN really dangerous? In a paper published in 2009 by Alessandro Acquisti and Ralph Gross in the Proceedings of the National Academy of Sciences of the United States of America, it was claimed (as I summarized here) that there is:

a correlation between an SSN and the birthdate of its “owner” that makes it feasible to infer the SSN, given knowledge of that birthdate and … public access to the Social Security Administration’s Death Master File … to determine SSN allocation patterns based on the zip code of their birthplace and the date of issue.

So how secure is your Social Security Number? Well, here a couple of issues:

  • Some legitimate, convenient-to-subscribe-to organizations may require it who are, nevertheless, not “entitled” to it.
  • The difference between legitimate and illicit organizations (or their web pages, URLs and so on) is not always as pronounced as you might think – otherwise, we wouldn’t have to worry about phishing.

A Social Security Number (like a National Insurance Number in the United Kingdom) is an identifier, not an authenticator, because it isn’t secret: many people know (or at least could gain access to) your SSN. But a problem arises whether or not an organization providing some kind of service to you insists on using it as an authenticator rather than as an identifier.  Even if a criminal doesn’t have direct access to an SSN, he may be able to guess it based on information aggregated from other sources.

The Social Security Office has stated in the past (apparently in the hope of making it easier to spot a fake) that the 9 digits of the Social Security Number are grouped as follows.

  • The first three digits represent the Area Number
  • The next two digits represent the Group Number
  • The four digits at the end are called the Serial Number

And, of course, it’s exactly those four final digits that are under discussion. According to an article in the LA Times from 2009, Acquisti and Gross were able”to identify all nine digits for 8.5% of people born after 1988 in fewer than 1,000 attempts. For people born recently in smaller states, researchers sometimes needed just 10 or fewer attempts to predict all nine digits.” However, the Social Security Office stated at that time that it was moving over to a more randomized SSN allocation system. Unfortunately, that probably hasn’t decreased the risk for many people whose SSN was already allocated by the time such changes were introduced.

Hopefully, most sites that ask for SSN info won’t allow unlimited guesses. Even more hopefully, few people will fall for a blatant, exaggerated data harvesting/phishing attempt resembling the meme described above.

The Sum of the Parts

But how about a story recently passed on by one of my colleagues in the security industry? He related how one of his friends received what appears to have been an automated phone call claiming that his or her debit card had been locked for fraud. Such calls are actually quite common, as in the cases described here, where the recording asks for the target to press 1 and then to ‘unlock’ their card by inputting sensitive financial information including the card number and the PIN associated with it in chip and PIN transactions. This isn’t a new threat, of course. A post at Scamcallfighters indicates that characteristically:

The automated system will ask the victim to key-in, card number, name, date of birth and even the security code! And at the end of it, it will declare that your card is reactivated!

In this case, however, the first thing requested was to input a full 9-digit SSN. Fortunately, the intended victim in this instance knew better than to actually give that information. I suspect, however, that a less greedy scammer might get quite a good hit rate in the right context.

By ‘less greedy’ I don’t just mean not asking for so many data items that even the most naïve end user might start to get suspicious, but also being prepared to do some data aggregation. After all, a victim who just volunteered 2-3 potentially useful data items is probably more likely than average to volunteer further items the second time round. And while a partial SSN requires more effort to build into a full SSN, the trade-off is that a victim is less likely to be scared off by a request for too much information.

After all, we’re conditioned to think that when a bank or other agency asks us to identify ourselves by giving part of an identifier or authenticator – “the 1st, 3rd and 4th character of your special word” or “the last four digits of your credit card number”, they already have the whole identifier/authenticator. Of course, this isn’t necessarily true at all. A scammer might even camouflage a harvesting probe by ‘sacrificing’ a data item that can’t be fully established so as to establish a context of trust in which the victim will:

  • Not take the trouble to check that the call is genuine by ending the call and calling back to a known-genuine number.
  • Go on to supply data items that can be used to implement some form of fraud.

However, in this case, a partial SSN might actually be enough to establish yet another useful (in terms of identity theft) data item.

Sadly, this use of automation for fraudulent purposes is another case where well-meaning (but not necessarily well-implemented) attempts by banks to reduce the impact of fraud has actually been perverted by criminals into an attack.

Technology versus Education

In the security industry, there’s a longstanding debate between those who advocate more user education and those who say that if education was going to fix the cybercrime problem it would have worked by now. (Randy Abrams and I discussed that debate at some length back in 2008: People Patching: Is User Education Of Any Use At All?

This particular threat exemplifies that conflict/tension: the efficiency of a technical solution – automated detection of fraudulent (or at least unusual) transactions – is compromised because card users are not well enough informed to distinguish between legitimate and fraudulent phone calls.

David Harley
ESET Senior Research Fellow

* Meme: An idea, behaviour, style, or usage that spreads from person to person within a culture. (Merriam-Webster)

The post Anyone want to know my Social Security Number? appeared first on We Live Security.