STE WILLIAMS

4 Benefits of a World with Less Privacy

The privacy issue is a problem for a lot of people. I see it differently.

I recently joined the Delete Facebook movement, but not because I thought removing my account would restore my online privacy.

I was ready to move on.

The truth is, the Internet knows the same about me today as it did when I was a member of the world’s largest social network. Whether or not I deleted my account is irrelevant to the state of my online privacy. There will still be a “Reg Harnish” shadow profile on the platform with thousands of pages of data. My profile will continue to grow as long as my friends and family continue to post photos and information about me — and as long as Facebook follows its practice of monitoring user behavior across the Internet via partner sites and ads.

My digital footprint isn’t going anywhere. That is, unless I decide to drop off the grid for the rest of my life; but, even then, my information still would be available, just buried beneath a sea of data.

The privacy issue is a problem for a lot of people. I see it differently. In fact, I believe society could benefit from a little less privacy. I’m certainly not advocating for the death of privacy. I tend to side with those who argue that privacy is an intrinsic value that shouldn’t be treated as a dispensable commodity. It is essential for self-development and, without some level of privacy, we would all lose our individuality and conform to one another.

With that said, here are three benefits of a world with less privacy:

Convenience: For the past 3,000 years, cultures commonly prioritized convenience and wealth over privacy. Internal walls in homes didn’t exist until 1500 A.D., with the development of the brick chimney, which needed support beams that ultimately segmented the home’s interior space. Before the 1700s, most homes had only one bed because they were too expensive to build.

Even today, just about every American has already unwittingly opted out of privacy for the convenience of surfing the web, monitoring their physical activity with fitness trackers, or receiving digital discounts at the grocery store, among many other online activities.

By devoting so much of our time online or opting in to terms and conditions, we have allowed third-parties not only to create digital copies of ourselves but also to predict our behaviors before we, ourselves, even know how we will behave. Taken to the next level, we could experience a new degree of convenience that rivals some of the best sci-fi films ever created. Already we are experiencing a degree of high-tech convenience that our forefathers could scarcely have imagined. Plus, with the recent push toward artificial intelligence and machine learning, computers may learn to guide us toward better decisions for our health, relationships, and lifestyles.

Reduced cybercrime: The simple fact that we place value on our privacy makes it worth stealing. For instance, Social Security numbers (SSNs) were never meant to be more than a way for tracking the earnings histories of workers in the US. Nowadays, you can’t do anything without providing that number for verification. What was once a worthless nine-digit number now can be used to open a bank account in someone else’s name, receive their benefits, and ultimately steal their identity.

The minute we stop using our SSNs as a form of ID, criminals would no longer be interested in stealing that information because it would be worthless. The same goes for all information. Of course, some degree of privacy is essential for maintaining national security and financial stability. But that doesn’t mean we should be assigning false value to outdated forms of identification. Just like our SSNs, if other information such as corporate databases, National Security Agency (NSA) records, and the security cameras that monitor our city streets were made public, criminals would be less likely to steal it because that information would be worthless on the market.

Live longer: Tailored advertisements and discounts showing up on your social feeds are just a couple of the many benefits of sharing personal information. Pulling back the curtain of privacy could save lives, too. Right now, our medical data is protected by the Health Insurance Portability and Accountability Act (HIPAA), but many people don’t realize that their health data could be the missing link preventing the next big breakthrough in medicine. If we shared our medical data freely, imagine the amount of data that medical providers, entrepreneurs, and companies could harness in the name of research. New medical treatments and cures would be discovered, perhaps, at unprecedented rates, not only saving lives but allowing humans to live longer.

Take the deadly drug Vioxx, for example. Researchers reported in a 2013 Iowa Law Review article that if patients who took the deadly drug had shared their health information publicly, statistics could have detected the side effects much earlier, possibly saving as many as 25,000 lives.

Transparency: Most people don’t think about how often their image is captured on a given day. For instance, the average American is photographed roughly 15 times during their drive to the supermarket. On that same trip, they’ll typically appear on about 90 seconds of video without ever knowing about it. The calls and texts they made on the way will also be monitored. The metadata will be sent instantly to databases around the globe and into the cloud, where it will be immediately, most likely, available to a select few. Our smartphones are broadcasting our exact locations at every moment, possibly sending the information to governments around the world, certainly to the NSA and to many others of which we are not aware.

But why should that information be limited to only a few? If we stopped demonizing the sharing of data, perhaps our information might be treated more democratically, as it was in simpler times when transparency was a common thread among villages and towns. Community members shared everything with each other. Everyone knew everything about you. Your favorite color and food. What made you laugh. Your kids’ names. Now we guard that information because we are so afraid someone is going to use it against us.

Having large sums of data and metadata in the hands of only a few, allowing them to dictate the flow of information, could set the stage for societal peril. Once information flows freely, governments will be forced to follow suit with transparency.

Privacy as we know it will never return to pre-Internet times. Instead of looking backward, let’s look forward and embrace a world where less privacy may be a good thing.

Related Content:

 

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Reg Harnish is an entrepreneur, speaker, author and CEO of GreyCastle Security, a leading cybersecurity firm headquartered in Troy, New York.
With two decades of experience practicing cybersecurity, Reg brings a thought-provoking perspective to the industry which has earned … View Full Bio

Article source: https://www.darkreading.com/endpoint/4-benefits-of-a-world-with-less-privacy/a/d-id/1332690?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Instagram fights misinformation and account hijackings with new tools

As we posted over on our Instagram Stories yesterday, Instagram has announced two new safety features to help users sift the wheat from the disreputable-account chaff, along with an improved form of two-factor authentication (2FA) that’s stronger than SMS text-based authentication.

Instagram co-founder and CTO Mike Krieger said in the post that the aim is to keep bad actors off the platform:

That means trying to make sure the people you follow and the accounts you interact with are who they say they are, and stopping bad actors before they cause harm.

The two bad-actor-sniffers are 1) a global verification form for notable public figures and 2) a new feature to help users evaluate the authenticity of accounts with large followings.

About This Account

In the coming weeks, users will be able to see more context about Instagram accounts that reach large audiences. Here’s how:

  • Go to the account’s profile.
  • Tap the menu icon.
  • Select Settings.
  • Select About This Account.
  • There, you’ll be able to check out when the account was created, the country it’s located in, accounts with shared followers, a year-long history of any name changes, and any ads the account is currently running.

This new feature reflects the push for transparency around advertisements and who buys them: a push that arose after Russian conspirators purchased ads on social media to spread disinformation and promote discord-fomenting rallies during the 2016 US presidential election.

Krieger said that this is what the Instagram community is asking for: a way to get a better understanding of accounts that reach a lot of people, particularly when such accounts share information about current events, or political or social causes, for example.

If users stumble across an account that seems to violate the platform’s Community Guidelines, Instagram says that they can report it.

In September, the tool will be made available to accounts with a big reach. Instagram is giving them the chance to review the information before it’s made available to the public.

Getting a “verified” badge

Instagram made available the second account-vetting tool on Tuesday: it’s a new way for accounts with a big reach to request a blue verification badge, via a form within the Instagram app.

Not all accounts are guaranteed to get a badge, Instagram says. Requirements include complying with Instagram’s Terms of Service and Community Guidelines. After that, the platform will review verification requests to confirm the “authenticity, uniqueness, completeness and notability of each account.”

To find out more, check out Instagram’s verification criteria at its Help Center.

To access the verification request form:

  • Go to your profile.
  • Tap the menu icon.
  • Select Settings.
  • Choose Request Verification.
  • You’ll be asked to provide your account username, full name, and a copy of your legal or business information. Instagram says that information won’t be shared publicly.

Say hello to third-party authenticator apps

Soon, Instagram will enable users to use third-party authenticator apps to log into their accounts: a form of 2FA that’s easier and safer for secure login than SMS text-based authentication.

As we’ve noted before, these are the two big “cons” when it comes to getting your 2FA codes via text:

  • A crook can hijack your SMSes with a SIM swap scam. If they can convince a mobile phone shop that they are you, they can get them to issue a replacement SIM encoded with your phone number. Your phone will go dead, and theirs will start receiving your calls and messages, including 2FA codes. An alleged SIM-swap scammer was recently arrested for allegedly stealing $5m in Bitcoin and other cryptocurrencies, for example.
  • NIST has declared that we can stick a fork in SMS-based 2FA: it’s done.

Here’s how to set up your Instagram account to use a third-party authenticator app:

  • Go to your profile.
  • Tap the Menu icon.
  • Select Settings.
  • Choose Two-Factor Authentication.
  • Select Authentication App.
  • If you’ve already installed an authentication app, Instagram will automatically find it and send it a login code. In that case…
  • Go to the app, retrieve the code, and enter it on Instagram. That will automatically turn on 2FA.
  • If you haven’t already installed an authentication app, Instagram will shuffle you on over to Apple’s App Store or Google Play to download the app of your choosing (Sophos has you covered here: consider downloading Sophos Authenticator which is also included in our free Sophos Mobile Security for Android and iOS). Once you’ve installed your chosen authenticator, return to Instagram to continue setting up 2FA.


Boosting Instagram security

These three new tools are a welcome addition to boost Instagram accounts’ security and to provide transparency into the sources of content and who’s advertising what on where. And this is just the start, Krieger promised:

We’ve been focused on the safety of our platform since the very beginning, and today’s updates build upon our existing tools, such as our spam and abusive content filters and the ability to report or block accounts.

We know we have more work to do to keep bad actors off Instagram, and we are committed to continuing to build more tools to do just that.


Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/Uw9LcjLAb1s/

Football team drops the privacy ball with email Cc blunder

Staff at the London football club West Ham United dropped the ball last week, emailing ticket confirmations to fans en masse, Ccing them all instead of sending them each a blind carbon copy (Bcc).

Any Bcc/Cc blunder is a breach of privacy, scattering email addresses far and wide. Some gaffes are worse than others, though …and more expensive.

Last month, the Information Commissioner’s Office (ICO) said that it had fined the Independent Inquiry into Child Sexual Abuse (IICSA) £200,000 (USD $260,000) over one such mistake, which exposed possible victims of child abuse.

The West Ham glitch is nothing as sensitive as that, in spite of one tweet:

But while it may not be as serious, that’s not to say that the football team is immune from the privacy watchdog’s notice. Will the slip lead to a fine?

The ICO hadn’t yet said anything about a potential inquiry or fine, according to The Register.

As some have pointed out, the ICO might well be inundated with plenty more consequential blunders than this one at this point: after all, in May, the GDPR came into its full, fine-inflicting legality.

What to do?

Well, what not to do is include everybody’s email in the To: or Cc: fields, like West Ham and so many others before it have done. Like, say, Ghostery, which did it, ironically enough, in an e-brag, “Happy GDPR Day” note about its “high standards” when it comes to user privacy.

“Don’t do it” = not much help? Nah, we don’t think so, either.

As we’ve said before, the commonality of Cc/Bcc goofs means that there’s either a basic design flaw in email, or that normal email clients might be the wrong tool for the job.

If your organization is sending sensitive emails, it’s worth it to look into hiding your email client’s To: and Cc: fields so that you simply can’t enter email addresses in a way that allows them to be shared. Alternatively, you could use an email marketing platform that sends an individual copy of your email to every person on a mailing list.


Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/ufOebn6BHx4/

Hacked stalking app reveals victims’ photos, texts and location info

Another mobile stalking app has been hacked, endangering both its customers and the victims that they spy on. According to Motherboard, an anonymous hacker gained access to servers at TheTruthSpy, a company that advertises software for jealous partners to track each other.

TheTruthSpy sells an iOS and Android app that enables someone to spy on someone else’s phone. The software is not available on official app stores and has to be installed on a jailbroken iPhone or via an alternative source on an Android phone. It should be installed onto “the phone they own and have proper consent to monitor,” according to the company’s website, which also advertises it for catching cheating spouses and has a section titled “how to hack a cell phone”. Hmm.

The site’s painfully-worded blurb reads thus:

If you are not able to make sure that whether your spouse is cheating on you or not, you can use a spying application to remove your doubts. Taking the help of spy apps, you can collect evidence against your spouse.

The software lets people track the location of a victim’s phone, view their call logs (including deleted ones) and record calls, monitor instant messages, SMS texts and browsing histories, and even eavesdrop on the victim wherever they are.

Exposing the keys to the kingdom

The hacker, who contacted Motherboard using the initials LM, reverse engineered the Android app and found a vulnerability that they used to access the company’s media server. There, they were able to access a list of unique customer IDs along with audio files.

They used the IDs as parameters in web queries, which returned the customers’ usernames and passwords in plaintext. A quick script enabled them to slurp 10,000 login credentials. This gave them access to pictures, audio recordings, location information and text messages from the spying victims’ phones. That’s a stalker’s dream, and puts thousands of people at risk.

The hack also affects the people doing the spying, too, because even in 2018, many people still reuse their passwords across multiple services. That enabled the hacker to break into email and PayPal accounts, among other things.

Motherboard verified the whole thing by checking to see if the accounts already existed. It found that half of them were still active, all of which goes to show that TheTruthSpy could use a competent coder, in addition to a decent copy-editor. The hacker has since lost access to the compromised accounts after TheTruthSpy updated its servers, the news outlet reported.

This isn’t the first spyware company to be hacked. Retina-X shuttered its app after being hit earlier this year.

Mobile spyware links to domestic abuse

TheTruthSpy also touts the app as a mechanism for monitoring employees and for parental control. This is a common modus operandi for what a research team from Cornell Tech, Cornell University and New York University calls ‘intimate partner surveillance’ apps that are common tools for domestic abusers.

Abusers have been documented using these apps to stalk their current or former partners. In some cases, they can go to extremes. One woman was arrested after installing tracker software on her boyfriend’s phone so that she could have him killed.


Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/YsJdanMvLAY/

Welcome! Mimecast finds interesting door policies on email filters

Inhouse email filters still miss millions of attacks – including malware attachments, impersonation and malicious links – the latest quarterly stats from cloud provider Mimecast have found.

The company used its Email Security Risk Assessment (ESRA) tool to assess the efficiency of email security in use by 37 organisations across 20 different industries.

Looking at 142 million emails – the overwhelming majority of which had been filtered by Microsoft and Proofpoint servers – the system spotted 15,656 with malware attachments that had been missed.

A further 13,176 containing potentially dangerous files also slipped through the net, as well as 41,605 deploying address spoofing.

Within a subset of just over 10 million emails, Mimecast found 203,000 with malicious links, or around one malicious email missed for every 50 inspected.

The rise in impersonation attacks was a standout theme, said Mimecast cybersecurity strategist Matthew Gardiner. “These are difficult attacks to identify without specialised security capabilities, and this testing shows that commonly used systems aren’t doing a good job catching them.”

The failure of email gateways to spot attacks meant that “targeted malware, heavily socially engineered impersonation attacks, and phishing threats are still reaching employee inboxes”.

A caveat with this is that Mimecast is comparing its cloud email filtering technology with on-premises servers. In Microsoft’s case, a more direct comparison might be with Exchange Online Protection (EOP).

Equally, it is the case that large numbers of organisations continue to rely on inhouse gateways that are at a disadvantage to cloud email security – or at least that’s the case Mimecast is trying to make. The argument is that email security should be multi-layered to avoid a single point of detection failure.

More surprising perhaps was the volume of spam gateways seem to miss – just over 19 million during Mimecast’s test, including those rejected and quarantined. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/08/30/email_filtering_missing_attacks/

Chinese hotel chain warns of massive customer data theft

China’s largest hotel chain is investigating an apparent data theft that is said to involve as many as half a billion pieces of information.

The Xinhua state news agency says Shanghai Police are investigating what looks to be a credible post on a darknet site advertising the sale of nearly 500 million pieces of data reportedly belonging to people who stayed at the chain of hotels Huazhu operates in China.

The data being advertised is said to include ID card details and hotel registration information for guests. The cost of the data was 8 bitcoins.

Hyatt

Malware again checks into Hyatt’s hotels, again checks out months later with victims’ credit cards

READ MORE

According to the Beijing News, the total number of people exposed by the data theft could be as many as 130 million, and the report claims that third-party security companies in China have already reviewed and authenticated the data as being a new cache, rather than a collection of previously-leaked details.

It goes on to cite China’s Zibao Technology in reporting that the data dump is believed to have come from a company programmer who uploaded an internal database to GitHub, suggesting the incident was an inside job.

Xinhua also notes that Huazhu is conducting its own internal investigation into the matter.

If confirmed, the data dump would immediately be among the largest ever to hit a hotel chain. Huazhu operates more than 3,000 hotels located in some 370 different Chinese Cities. By comparison, the 2016 theft at Hyatt Hotels included just 250 locations, and the 2015 hack at Starwood only covered around 54 locations.

Hotels have long been a favorite target of data thieves. Because everyone who checks into a hotel would be using a payment card and ID, point of sale and reservations systems present a trove of useful data for fraudsters and can fetch a pretty penny in cybercrime forums and markets. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/08/29/chinese_hotel_data_theft/

Passport Numbers Exposed in Air Canada Data Breach

Mobile app hit in cyberattack that compromised 20K user accounts.

Air Canada has alerted users of its mobile app of a data breach that exposed personal information – including stored passport numbers – of some 20,000 users.

The airline said after noticing “unusual login behavior” on the Mobile+ app from Aug. 22 to 24, it blocked that traffic and locked all Air Canada mobile app accounts. Customers now must reactivate their accounts on the app, which is back up and running.

“We contacted potentially affected customers directly by email starting Aug. 29 to tell them if we determined their account may potentially have been accessed improperly,” Air Canada said on its website. “We are also requiring all Air Canada mobile app users to re-set their passwords using improved password guidelines to further enhance security measures. A more robust password provides an extra layer of protection.”

Account-holder names, email addresses, and telephone numbers were exposed in the breach, in addition to passport numbers of those users who stored that information in their profiles. The airline has some 1.7 million mobile app users but said only 1% of the user accounts were accessed by the attackers.

Read more here.

 

 

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/passport-numbers-exposed-in-air-canada-data-breach/d/d-id/1332695?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Error Canada: Airline tells customers to reset mobile app after attack

Air Canada is advising customers to reset the passwords on their mobile app after the airline detected a potential network break-in.

“We detected unusual login behaviour with Air Canada’s mobile App between Aug. 22-24, 2018. We immediately took action to block these attempts and implemented additional protocols to protect against further unauthorized attempts,” Air Canada said in a notice to customers.

“As an additional security precaution, we have locked all Air Canada mobile App accounts to protect our customers’ data.”

Air Canada estimates that as many as 20,000 of the 1.7 million people who use the app may have had their profiles accessed by hackers. Customers who were exposed will be contacted directly via email. Everyone who uses the app, however, is being advised to reset their password as a precaution.

The lost data consisted of: Aeroplan number, passport number, NEXUS number for expedited screening, known traveler number, gender, birth date, nationality, passport expiration date, passport country of issue and country of residence.

shutterstock_56353756-band

Fender’s ‘smart’ guitar amp has no Bluetooth pairing controls

READ MORE

The airline said that credit card information remains protected and that no other data from its Aeroplan frequent flier program was accessed. The airline notes that while some users stored passport information on the app, the exposed data would not be enough on its own to allow for a new passport to be issued.

Aircanada.com accounts are not linked to the mobile app accounts and therefore are not believed to have been exposed.

While it doesn’t seem that any of the lifted information could be used by a criminal to make fraudulent reservations or obtain a passport under the victim’s identity, Air Canada says it is advising all customers to keep an eye on their bank statements and Aeroplan accounts for any unauthorized transactions.

As of Wednesday, it seemed customers were taking the advice to heart. So many people were attempting account resets that people are now being told wait a little while to change their passwords.

“Due to the large volume, some customers may experience a delay in the process to change their passwords,” the airline said.

“We ask customers to be patient and assure them their data is protected and not accessible to unauthorized users. We apologize for the delay. Please wait several hours and try again.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/08/29/error_canada_airline_tells_customers_to_reset_mobile_app_after_attack/

Instagram Debuts New Security Tools

Updates include a new feature to verify the authenticity of popular accounts and a means of integrating two-factor authentication.

Instagram today announced three security updates intended to drive trust in the platform and lessen the likelihood of fraudulent, and potentially malicious, accounts influencing users.

First, the social networking app, which confirmed a security incident earlier this month, announced plans to help users evaluate the authenticity of large Instagram accounts. Via an “About This Account” menu item, users will be able to access data including the date the account joined Instagram, where it’s located, accounts with shared followers, username changes in the past year, and any ads the account might be running.

Accounts with broad reach will be able to review this information in September before it reaches a global audience, said Instagram co-founder and CTO Mike Krieger, in a blog post.

In another update, Instagram – which typically lets large accounts (public figures, celebrities, global brands) verify their identities with a blue checkmark next to their usernames – has launched a new way to request verification. To do so, an account holder will have to access a verification request form within the app and provide a username, full name, and legal or business identification.

Finally, users will soon have the option to use third-party authenticator apps to access their accounts, according to Krieger. Setup can be done within the app; if you already use an authentication app on your phone, Instagram will automatically find it and send a login code.

Read more details here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/application-security/instagram-debuts-new-security-tools/d/d-id/1332693?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Telecommunications Industry in the Bullseye

New report cites higher volume and increased sophistication of threats to the sector.

The telecommunications sector has been experiencing a heightened number of attacks from threat actors – both in frequency and the level of sophistication.

According to a new report by managed services provider Lastline, 1 in 370 files submitted to the company from the telecom sector were malicious, compared with one in every 500 across all industries. 

Andy Norton, director of threat intelligence for Lastline, says 1 in 10 of those 370 files consisted of all four of the main characteristics of a malicious file, as opposed to one in 12 across all industries. Those four main qualities of advanced malware, according to Norton, include bypassing static analysis using packers; evading dynamic analysis; remaining on a host undetected by masquerading as or injecting trusted system files; and stealing credentials to move laterally inside the victim organization.

In a post on the report, Norton says the reason for the variance between the telecom sector and the global sampling may be that telecom experiences a higher malicious encounter rate than other verticals, or it could also be the higher levels of security in the telecom sector that more effectively pre-filter files before submitting them to Lastline. 

“And while this may appear in relative terms like a very small deviation, when one considers the total volume of email attachments received and Web pages visited in any given day by the telecoms, the volume of malicious samples escaping detection can become quite large,” he wrote.

But Josh Zelonis, an analyst with Forrester Research, maintains that the telecom data doesn’t necessarily indicate it’s a bigger target. “Without understanding the [study’s] submission process for the organizations, it’s impossible to come to a strong conclusion about what the numbers mean,” says Zelonis. “It could be that compared to other industries, the telecoms are better filtering out files they know for sure are not malware before submitting to Lastline.” 

Lastline’s Norton agrees with Zelonis’ take that the telco sector is probably better at filtering out files that they know are malware.

However, Norton says, “the gray area in between the good and bad files submitted leads to a higher saturation rate in telco. It does say as much about the sophistication of telecom as it does about the sophistication of the attack. A more sophisticated defense necessitates a more sophisticated attack.”

Related Content:

 

 

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Steve Zurier has more than 30 years of journalism and publishing experience, most of the last 24 of which were spent covering networking and security technology. Steve is based in Columbia, Md. View Full Bio

Article source: https://www.darkreading.com/endpoint/telecommunications-industry-in-the-bullseye/d/d-id/1332696?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple