STE WILLIAMS

Fraudulent dating and relationship apps and websites raise the risks for those seeking online romance on Valentine’s Day.

The US Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) is joining the Valentine’s Day celebration by reminding people that it’s not true love if they ask for money. In a bulletin released earlier today, the agency counsels caution and skepticism over romance and recklessness when it comes to online dating and relationships.

CISA’s warning has been amplified by Kaspersky’s findings this week of malicious files that have mimicked the names and designs of more than 20 legitimate dating services.

According to the researchers, they have identified more than 1,900 unique files spread in 2019 that masqueraded as legitimate dating and relationship apps. Two-thirds of the total (1,262 files) posed as Tinder. Kaspersky warns that activity around these fraudulent dating site file typically skyrockets in the days leading up to Valentine’s Day.

For more, read here and here.

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s featured story: “Coronavirus Raises New Business Continuity, Phishing Challenges for InfoSec“

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/dhs-warns-of-cyber-heartbreak/d/d-id/1337062?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Informa Tech combines Ovum, Heavy Reading, Tractica, and IHS Markit research.

Renowned IT market research firm Ovum plans to expand its cybersecurity coverage under a newly formed tech research organization that combines Ovum, Heavy Reading, Tractica, and IHS Markit.

Omdia — which is part of research, media, training, and events firm Informa Tech (Dark Reading’s parent company) — officially launches on February 20 and integrates the operations of all four research houses, which include more than 400 analysts and consultants in some 150 technology markets.

The combination of Ovum and IHS Markit pairs the traditionally qualitative research expertise of Ovum with the quantitative resources of IHS Markit, says Maxine Holt, research director with Omdia and formerly of Ovum.

“We’re combining the resources of IHS Markit’s cybersecurity research, which includes threat mitigation and a whole range” of security topics, including Internet of Things (IoT) security, she says.

Holt says among the main areas Omdia’s cybersecurity practice will encompass are infrastructure security (next-gen firewalls, unified threat management, advanced threat protection); security operations including SIEM and security orchestration, automation, and response (SOAR); identity and authentication; and data security and privacy, including encryption.

Security topics — such as industrial IoT, cloud security, and managed security services — touch all of those areas as well. “We’re expanding the buckets of our research so clients can take a cross-section” of the content as well, she says.  

Omdia last week published a report on 5G that includes a look at cybersecurity issues.

Read more here.

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s featured story: “Coronavirus Raises New Business Continuity, Phishing Challenges for InfoSec“

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/operations/ovum-to-expand-cybersecurity-research-under-new-omdia-group/d/d-id/1337060?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

An old domain that has lain dormant for 26 years is going on sale – and the results could be catastrophic for enterprises with poorly configured Active Directory setups.

Brian Krebs reports that Mike O’Connor, a domain prospector who registered corp.com in 1994, wants to sell the domain for $1.7 million as he simplifies his estate. Most other domains would simply be a useful way to generate web traffic, but corp.com is different.

The problem lies with Microsoft’s Active Directory. This product, which provides identity management services across most of the world’s enterprises, handles internal URLs using its own domain naming system which is connected to but separate from the public domain naming system (DNS).

Because Active Directory is controlling what happens inside the company network, the company can host its services on whatever domains it likes. So, let’s say that your company hosts all of the services that its employees can access from inside the company network on the example.com domain.

The company HR portal might be accessible via a Fully Qualified Domain Name (FQDN) like hr-portal.example.com, for example, assuming that example.com was your company’s domain. Active Directory ensures that people inside the company network who type hr-portal.example.com into their browser are sent to the company HR portal.

No one wants to type in the full name for a server that they visit every day from inside the company network. So Windows makes that easier too, using a feature called DNS devolution. It works by appending portions of the Active Directory domain to an unqualified domain name. In our example, you could just type hr-portal, and Windows will try appending .example.com to see if it gets a hit.

Windows machines use a search list to tell them what to use during DNS devolution. The search list is either configured in the registry or sometimes declared explicitly in a file. As section 3.1 of this ICAAN Security and Stability Advisor Committee document on DNS search list processing points out, search list processing is affected by factors including the computer’s hostname (which you’ll be asked for when setting up business versions of Windows).

If you try to access hr-portalfrom outside the company network and your computer has the hostname example.com, your computer will probably contact an external DNS resolver, which will look up the public records for example.com.

That’s fine, so long as your hostname is a domain that your company owns. If your company controls the public DNS records for example.com, it can direct your request somewhere useful, or at least harmless, when you’re outside the company network.

But what if the company used a domain that it doesn’t own for its Active Directory?

That’s a problem called namespace collision, and it can spell trouble. If an attacker registers example.com, they can direct unsuspecting users to phishing sites, collect their emails, and worse.

No one would be daft enough to use an Active Directory domain that they didn’t own, right? Unfortunately, early versions of Windows that ran Active Directory used corp as the default Active Directory domain. Companies that didn’t reset it to a subdomain they owned now have an Active Directory implementation using corp. Active Directory’s technical architecture makes that very hard to change, according to Jeff Schmidt. He’s the CEO of JAS Advisors, a security consultancy that evaluated namespace collision dangers for ICAAN.

If that corp domain lies at the end of your Active Directory, you have a problem. An Active Directory-registered machine logging on from outside the network will try a variety of things in its search list until it finds a match. It will eventually hit your hostname (example.com). If you don’t have control of the hostname domain and can’t guarantee that it will resolve, Windows starts trying to find a match in portions of the hostname, up to and including the top level domain of the hostname, which in many cases will be .com.

So if you have corp at the end of your Active Directory domain (as was the default for early versions of the product) and you look up hr-portal.corp on your company network, your Active Directory controller will recognise it and resolve it. When outside your network, though, that query will fail because the Active Directory controller isn’t there to handle the corp part.

The computer will start trying to resolve DNS queries using its search list, gradually devolving the list – including the hostname on the list. If your computer has .com in its search list, or a hostname ending in .com that won’t resolve, it will eventually try to resolve the partial URL against the .com top-level directory alone. hr-portal.corp.example.com? Nope. hr-portal.example.com? Nope. How about hr-portal.corp.com? Or corp.com?

Admins will often misconfigure explicit search lists just to get things to work, warns Schmidt:

Your admin through group policy can actually create a search list manually. That happens a lot, particularly in enterprises that have glued together a bunch of things over the years.

He has also seen admins configure .com directly into search lists as a catch-all to ensure that queries resolve.

The danger of a computer resolving to corp.com wasn’t an issue as long as O’Connor owned the corp.com domain, but now that he’s selling it off, it creates a potential problem. An unscrupulous buyer could potentially use that domain as a watering hole for anyone whose company still uses corp at the end of its Active Directory domain suffix list.

This isn’t just hypothetical, says Schmidt. JAS Advisors conducted an experiment with O’Connor to see what kinds of traffic were hitting the dormant corp.com domain. They saw a river of sensitive data including logins and emails. “I know, I’ve seen the data,” he says. “I have the 30+ queries/second to show it.” Luckily, they were able to destroy the data and discontinue the experiment.

If the domain falls into less benevolent hands, someone could use it to mount attacks on companies that haven’t switched out their corp Active Directory domains or installed updates.

What to do

What should companies do about this? Unfortunately, explains Schmidt, it’s very difficult to get rid of the corp domain once it’s in your Active Directory. “Never ever in any context but in Active Directory especially never use a namespace you don’t control. Because you never know who will,” he says.

Instead, use a domain that you own for your Windows hostnames, and name your internal machines and services using subdomains of it.

You should also take a corporate laptop to the local coffee shop and then check its DNS query logs to see how it’s resolving its domains outside the company network, and adjust your configuration accordingly, Schmidt concludes.

---

Latest Naked Security podcast

LISTEN NOW

Click-and-drag on the soundwaves below to skip to any point in the podcast. You can also listen directly on Soundcloud.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/eNE2lUuM6GI/

A popular self-driving car dataset for training machine-learning systems – one that’s used by thousands of students to build an open-source self-driving car – contains critical errors and omissions, including missing labels for hundreds of images of bicyclists and pedestrians.

Machine learning models are only as good as the data on which they’re trained. But when researchers at Roboflow, a firm that writes boilerplate computer vision code, hand-checked the 15,000 images in Udacity Dataset 2, they found problems with 4,986 – that’s 33% – of those images.

From a writeup of Roboflow’s findings, which were published by founder Brad Dwyer on Tuesday:

Amongst these [problematic data] were thousands of unlabeled vehicles, hundreds of unlabeled pedestrians, and dozens of unlabeled cyclists. We also found many instances of phantom annotations, duplicated bounding boxes, and drastically oversized bounding boxes.

Perhaps most egregiously, 217 (1.4%) of the images were completely unlabeled but actually contained cars, trucks, street lights, and/or pedestrians.

Junk in, junk out. In the case of the AI behind self-driving cars, junk data could literally lead to deaths. This is how Dwyer describes how bad/unlabelled data propagates through a machine learning system:

Generally speaking, machine learning models learn by example. You give it a photo, it makes a prediction, and then you nudge it a little bit in the direction that would have made its prediction more ‘right’. Where ‘right’ is defined as the ‘ground truth’, which is what your training data is.

If your training data’s ground truth is wrong, your model still happily learns from it, it’s just learning the wrong things (eg ‘that blob of pixels is *not* a cyclist’ vs ‘that blob of pixels *is* a cyclist’)

Neural networks do an Ok job of performing well despite *some* errors in their training data, but when 1/3 of the ground truth images have issues it’s definitely going to degrade performance.

Self-driving car engineers, please use the fixed dataset

Thanks to the permissive licensing terms of the open-source data, Roboflow has fixed and re-released the Udacity self-driving car dataset in a number of formats. Dwyer is asking those who were training a model on the original dataset to please consider switching to the updated dataset.

Dwyer hasn’t looked into any other self-driving car datasets, so he’s not sure how much bad data is sitting at the base of AI training in this nascent industry. But he has looked at datasets in other domains, finding that Udacity’s Dataset 2 was particularly bad in comparison, he told me:

Of the datasets I’ve looked at in other domains (eg medicine, animals, games), this one stood out as being of particularly poor quality.

Could crappy data quality like this have led to the death of 49-year-old Elaine Herzberg? She was killed by a self-driving car as she walked her bicycle across a street in Tempe, Arizona in March 2018. Uber said that her death was likely caused by a software bug in its self-driving car technology.

Dwyer doesn’t think bad data quality had anything to do with the tragic crash. According to a federal report released in November, the self-driving Uber SUV involved in the crash couldn’t figure out if Herzberg was a jaywalking pedestrian, another vehicle, or a bicycle, and it failed to predict her path’s trajectory. Its braking system wasn’t designed to avoid an imminent collision, the federal report concluded.

I’ve reached out to Vincent Vanhoucke, principal scientist and Director of Robotics at Google, who teaches the Udacity course on becoming a self-driving car engineer, to get his take on the bad data and to find out if he plans to update to the fixed dataset. I’ll update the article if I hear back.

Over the coming weeks, Roboflow will be running some experiments with the original dataset and the fixed dataset to see just how much of a problem the bad data would have been for training various model architectures.

For now, Dwyer’s hoping that Udacity updates the data set it’s feeding self-driving car engineering students and that the companies actually putting cars on the road are more diligent at cleaning up their AI training materials than what this open-source dataset might suggest:

I would hope that the big companies who are actually putting cars on the road are being much more rigorous with their data labeling, cleaning, and verification processes.

---

Latest Naked Security podcast

LISTEN NOW

Click-and-drag on the soundwaves below to skip to any point in the podcast. You can also listen directly on Soundcloud.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/O3azSOGnuHw/

Facebook has delayed the rollout of its new dating feature in Europe, following officers from the Irish data regulator having popped by to ask why Facebook hadn’t checked in about it earlier or provided the necessary data privacy paperwork.

The Irish Data Protection Commission (DPC) said on Wednesday that Facebook Ireland hadn’t bothered to contact the DPC about its intention to roll out the new dating feature in the EU until Monday, 3 February. That’s not much time, the DPC said, given that this is the first we’ve heard about it, and given that Facebook planned to roll it out just 10 days later.

We were very concerned that this was the first that we’d heard from Facebook Ireland about this new feature […]. Our concerns were further compounded by the fact that no information/documentation was provided to us on 3 February in relation to the Data Protection Impact Assessment [DPIA] or the decision-making processes that were undertaken by Facebook Ireland.

Facebook first started talking about invading Tinder’s space with a dating feature for meeting non-friends back in May 2018 at its F8 developer conference. Then, it launched the in-app dating feature – called Facebook Dating – in September 2019 in the US, after having previously premiered it in 19 other countries, including Colombia, Canada, and Thailand.

Facebook says that it had, in fact, completed the necessary paperwork and shared it when asked. The BBC quoted a Facebook representative:

It’s really important that we get the launch of Facebook Dating right, so we are taking a bit more time to make sure the product is ready for the European market.

We worked carefully to create strong privacy safeguards and complete the data-processing impact assessment ahead of the proposed launch in Europe, which we shared with the [regulator] when it was requested.

When TechCrunch asked Facebook why, if it’s “really important” to get the launch “right,” it didn’t provide the DPC with the required documentation in advance instead of the regulator having to send agents to Facebook’s offices to get it themselves, Facebook said that the company doesn’t think it’s under obligation to do so:

We’re under no legal obligation to notify the IDPC of product launches. However, as a courtesy to the Office of the Data Protection Commission, who is our lead regulator for data protection in Europe, we proactively informed them of this proposed launch two weeks in advance. We had completed the data processing impact assessment well in advance of the European launch, which we shared with the IDPC when they asked for it.

The General Data Protection Regulation (GDPR) requires a DPIA any time a new project kicks off that’s likely to involve “a high risk” to other people’s personal information, be it through individual profiling or processing of sensitive data on a large scale.

A dating app that ties into Facebook’s cornucopia of personal data certainly falls within that sphere.

Facebook hasn’t given any indication of when the new release date will be for Facebook Dating in the EU.

---

Latest Naked Security podcast

LISTEN NOW

Click-and-drag on the soundwaves below to skip to any point in the podcast. You can also listen directly on Soundcloud.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/roQf9-KHcLw/

The contentious case of a man held in custody since 2015 for refusing to decrypt two hard drives appears to have reached a resolution of sorts after the US Court of Appeals ordered his release.

Former Philadelphia police sergeant Francis Rawls was arrested in September 2015, during which the external hard drives were seized along with other computers from his home.

Based on forensic analysis of his download habits and the testimony of his sister, the police believe they contained child abuse imagery but were unable to prove that without access to the drives.

Rawls claimed he did not know or had forgotten the passcodes while his lawyers argued that on principle forcing him to reveal these violated his Fifth Amendment right against self-incrimination.

Ruled in civil contempt of court, in 2017 a second court rejected the Fifth Amendment argument.

Never formally charged with a crime, a lot seems to have hinged on whether Rawls should be treated as a suspect or a witness. If Rawls was considered a witness, the fact that he’s being asked to provide information that could be used against himself, is, in effect, self-incriminating testimony.

From the start, this was an unusual case that will be referenced for years to come, not last by the civil liberties campaigners who took up the case and opposed the Government’s arguments.

The prosecutors said they had ample evidence of Rawls’ alleged downloading of child abuse images but seemed happy to leave him in jail without charge.

Their assumption that he knew the passcode meant that he would surely relent rather than languish in jail indefinitely. And yet, Rawls didn’t relent, perhaps calculating that the courts would eventually take his side in a highly technical argument.

Rawls has now been released on the basis that the detention under civil contempt does not allow prosecutors to hold a witness for longer than 18 months.

But there was always a technical dimension hovering over this case – the hard drives were reportedly encrypted using Apple’s FileVault software.

Although Rawls could have been using any encryption software, Apple’s involvement must have hit a nerve.

The company has been in dispute with the Government over a series of cases, most famously attempts to force Apple to aid access the iPhone of the San Bernardino shooter in 2015. More recently, the iPhone access issue came up again after a shooting at a US Naval base.

The Rawls case is different in that it’s not the company being pursued but the suspect. But it underlines the battle now happening between companies offering encryption which can be used by anyone and a Government keen to head off the inconvenience this creates.

In January it was alleged that Apple has been more cooperative with the Government than it’s yet admitted, rowing back on a plan to extend end-to-end encryption to iCloud backups.

Ultimately, the FBI would like a backdoor only they could use, a move Apple has resisted.

But failing that, there’s always the front door. Rawls seems to have held out against demands for encryption passcodes, but he won’t be the last to be asked.

---

Latest Naked Security podcast

LISTEN NOW

Click-and-drag on the soundwaves below to skip to any point in the podcast. You can also listen directly on Soundcloud.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/-PcVPhz2bC0/

A popular GDPR compliance WordPress plugin vendor has patched a flaw that rendered both site visitors and admins vulnerable to cookie-stealing cross-site scripting (XSS) attacks.

The GDPR Cookie Consent plugin, created by WebToffee, claims over 700,000 users. The plug-in is a notification app that begs you to accept cookies when you first visit a WordPress site. Website owners use tools like this to stay compliant with GDPR, which points to cookies as a form of online identifier and therefore subject to its consent rules.

While the GDPR Cookie Consent plugin asks you if you’d mind accepting cookies, it doesn’t ask you if you’d like a dollop of XSS with them too. Until this week, that’s what visitors to pages containing the plugin might have been vulnerable to.

The flaw, enabled an XSS attack and elevation of privilege in versions 1.82 and earlier, said a blog post by The Ninja Technologies Network, which sells web application firewalls to protect WordPress sites.

According to Wordfence, the cause of the vulnerability was an AJAX endpoint used in the administration section of the plugin (AJAX uses JavaScript and XML to deliver web page functionality). This exposes three functions to blog subscribers that should only have been available to admins: get_policy_pageid, autosave_contant_data(“contant” is a typo in the code itself), and save_contentdata. The first just returns a post ID for the plugin’s cookie policy page and isn’t really significant, Wordfence said.

The second defines the standard content for that page and is more worrisome. Because the HTML is unfiltered, an attacker could alter it to contain JavaScript code. That means they could use it to deliver an XSS payload to any user that viewed it on its /cli-policy-preview/ page.

The third function creates or updates the post that bugs users to accept the cookie policy when they visit a site. Attackers can alter the post_id that this function delivers to change the text of any post, but doing so sets the post’s status to draft, hiding it from regular subscribers. That still leaves it visible to editors, admins, and the author of the post. An attacker could, therefore, use an altered post to mount an XSS attack on one of these privileged users.

Doing that takes another bit of skullduggery, explains Wordfence. WordPress uses a whitelist of permitted HTML tags when editing content, which would strip out malicious code like XSS payloads. However, the plugin permits shortcodes. These are commands a bit like macros contained in square brackets that WordPress blogs and their plugins interpret as shortcuts to include rich text like image galleries and videos.

By using shortcode functionality in the plugin, an attacker can hit a site admin with an XSS attack. The attackers could also insert formatted text, hyperlinks, and remote images, explained Ninja Technologies.

What to do

The bug has a CVSS score of 9.0, said Wordfence, which makes it critical, although at the time of writing there wasn’t an assigned CVE number.

WebToffee has released an updated version, 1.83, and any admins should patch their deployments immediately.

---

Latest Naked Security podcast

LISTEN NOW

Click-and-drag on the soundwaves below to skip to any point in the podcast. You can also listen directly on Soundcloud.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/uCTRH0KiVPg/

The National Crime Agency has publicly distanced itself from a poster urging parents to call police if their child has installed Kali Linux, Tor or – brace yourself – Discord.

Issued by West Midlands Regional Organised Crime Unit (WMROCU) via local area councils, the poster in question lists a slack handful of common infosec tools – as well as some that clearly have nothing to do with computer security.

Should your child install Kali Linux, virtual machines (the image on the poster looks like Virtualbox) or internet privacy tool Tor, West Midlands Police wants to know immediately. And if – heaven forfend – junior installs Metasploit, free VoIP service for gamers Discord or WiFi Pineapple, you might as well report straight to your nearest prison and abandon your tainted offspring forever.

“If you see any of these on their computer, or have a child you think is hacking, let us know so we can give advice and engage them into positive diversions,” intones the offending poster, forwarded to us by a reader and which we reproduce below in all its glory.

West Midlands Regional Organised Crime Unit’s silly poster. Click to enlarge

Observant readers will have spotted the National Crime Agency logo alongside that of the WMROCU. Strangely enough, the NCA was not at all impressed to have been linked with this obvious bollocks.

Good evening – the NCA was not involved in the production or release of this poster.

There are many tools which tech-savvy children use, some of which can be used for both legal illegal purposes, so it is vital that parents and children know how these tools can be used safely.

— National Crime Agency (NCA) (@NCA_UK) February 13, 2020

The Register has emailed WMROCU via the address on the poster to ask some pertinent questions. If the coppers reply, we’ll update this article – though we have a sneaky feeling they’re probably hoping all of this goes away.

Snark aside, ignorance about infosec abounds. Even Metasploit, highlighted in the WMROCU poster as an example of nefarious hacking software, has entirely legitimate uses: a quick internet search for UK infosec courses shows plenty of syllabi that include how to use Metasploit as a white hat tool.

Let’s hope West Midlands Police learns something useful from this cockup. ®

Sponsored:
Detecting cyber attacks as a small to medium business

Article source: https://go.theregister.co.uk/feed/www.theregister.co.uk/2020/02/14/silly_police_infosec_parental_advice_poster/

Encrypted email service Tutanota on Thursday accused US mega-telco ATT of blocking its service in some parts of America, and cited the service interruption, ongoing for more than two weeks, as evidence for the need for net neutrality.

“Starting on January 25th 2020, we have had constant complaints from ATT mobile users who were unable to access their encrypted Tutanota mailbox,” company co-founder Matthias Pfau, wrote in a blog post on Thursday. “While ATT seemed willing to fix this when we reached out to them, the issue is still not solved and reports from users keep coming in.”

Pfau said Tutanota, because it’s based in Germany, has been unable to conduct its own network tests, but added that customers have confirmed being blocked on ATT mobile connections in Chicago.

“No ISP should have the right to block or throttle access to any website,” said Pfau. “We hope that ATT will lift this regional block soon.”

However, it may be premature to link the lingering application-specific outage to as-yet-unproven network favoritism.

ATT insists it isn’t blocking Tutanota, at least not deliberately, and claims it’s trying to address the issue.

“We are aware that some of our customers have reported trouble accessing Tutanota email service,” an ATT spokesperson said in an email to The Register. “We are working with them to resolve this as quickly as possible.”

ATT’s spokesperson declined to provide further details about the cause of the service problems.

Net neutrality refers to the notion that network traffic should be carried by network providers on a non-discriminatory basis. This was the basis for internet data traffic pretty much since its inception, but telcos increasingly disliked the practice.

In 2015, America’s comms watchdog – the FCC – enacted formal rules enforcing net neutrality to settle the matter once and for all. Then the Republican Party won the next election, and the new FCC, led by chairman and ex-telco executive Ajit Pai, voted in December 2017 to repeal net neutrality rules. While that decision remains the subject of legal wrangling, there’s ample evidence that network providers sometimes play favorites.

Computer science researchers from Northeastern University and University of Massachusetts Amherst published a study last year showing that almost all wireless carriers throttle selected video streaming services. ATT, for example, was found to have limited bandwidth to Netflix and YouTube about 70 per cent of the time, but didn’t do so for Amazon Prime Video.

And in 2018, Sprint was found to be throttling traffic to Microsoft Skype, which competes with its own VoIP service.

Even so, Tutanota’s decision to ring the net neutrality alarm bell without presenting evidence of deliberate network meddling makes this more a matter of support escalation than of malice. As Pfau acknowledges in his post, “we are reaching out publicly in the hope of getting the attention of the right people at ATT.” ®

Sponsored:
Detecting cyber attacks as a small to medium business

Article source: https://go.theregister.co.uk/feed/www.theregister.co.uk/2020/02/14/att_tutanota_block/

This week we welcome back Peter who discusses RobbinHood – the ransomware that brings its own bug. Greg explains how a student’s Twitter account was handed over to their college and Duck talks SMS 2FA.

Host Anna Brading is joined by Sophos experts Peter Mackenzie, Paul Ducklin and Greg Iddon.

Listen now!

LISTEN NOW

Click-and-drag on the soundwaves below to skip to any point in the podcast.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/Cq2ETGlwMro/