STE WILLIAMS

Post-Quantum Crypto Standards Aren’t All About the Math

The industry needs to keep in mind the realities of hardware limits and transitional growing pains, according to Microsoft, Utimaco researchers.

The race for developing post-quantum cryptographic standards is well underway. Already the brightest minds in cryptographic research are in the middle of duking it out to decide what the best methods will be to make sure encrypted secrets stay safe from the brute-force computing power of quantum computers.

As experts explain, quantum computers will very soon render most of today’s advanced cryptographic methods obsolete. The window of when that will realistically happen is up for debate, but recent developments, such as IBM’s release of its first commercial quantum computer last month, show that it’s definitely on the foreseeable horizon. 

“There’s a huge transition that we’re facing,” says Dr. Brian LaMacchia, a distinguished engineer and head of the Security and Cryptography Group at Microsoft Research. “[It’s] bigger than the transition from MD5 to SHA-1 hash functions or SHA-1 to SHA-2 because we effectively need to upgrade everything that uses public key cryptography before the advent of quantum computers.”

Even if quantum computers don’t proliferate until 2030, that’s not a whole lot of time to account for a cryptographic transition like this, he says. That is why NIST is running a competition among academics to test and prod different theoretical ways to solve the post-quantum cryptography problem. It has been going for a little over a year now, and recently it whittled down proposed methods by more than half. LaMacchia’s team at Microsoft submitted four different methods, all of which are among the remaining 26 proposals.

As the competition kicks into its next phase, LaMacchia and others, including Avesta Hojjati, head of DigiCert Labs, say the industry needs to be mindful of the complete picture of how encryption is applied today as they make decisions for the post-quantum world. The math is only part of the equation, they explain. Researchers and security architects also need to be mindful of how a proposed solution is going to work within the limitations of where hardware and software stacks are going in the coming decades. 

In particular, they’ll need to think about the encryption of widespread Internet of Things (IoT) devices, many of which will require researchers to consider two major factors: lifespan and compute limitations.

“IoT devices are widely used, and they have a very long life cycle after they’re deployed,” Hojjati says. “You can imagine a sensor that will be deployed in an ocean to collect information about climate change will probably reside in that ocean for the next 20 to 60 years, and that sensor requires some kind of security.”

Not only are IoT devices long-lived, but they’re often completely integrated into expensive equipment that has physical safety implications. Take cars, for instance, which have tons of IoT devices built into their controller units. The point is that the expense will be very high for organizations to change out cryptographic methods on these kinds of devices once they’re in the field. That means researchers need to get it right out of the gate.

“Of all of the quantum-resistant algorithms that are currently under consideration, none of them actually has the performance and key size characteristics combined that something like RSA does. So either it takes you longer to do the key setup or a key encryption, or the public key is significantly larger, or the amount of data you have to transfer is significantly larger than what we’re used to,” LaMacchia says. “You actually want to test this out now to figure out whether or not your engineering is going to be able to handle the larger key sizes or whatever the performance characteristics come of whatever eventually gets standardized. It’s important to make sure you don’t have an implicit limitation somewhere in your software stack.”

This was the rationale behind recent testing that LaMacchia’s and Hojjati’s teams conducted with Utimaco to see whether one of Microsoft’s algorithms would play nicely with certificates issued by DigiCert and used with Utimaco Hardware Security Modules.  

Moving forward, additional methods will be needed that generally smooth the transition to quantum safe cryptography without compromising the security or stability of existing encryption applications, LaMacchia says. This is going to take a hybrid approach, he adds, as the community proves out the quirks and limitation of these new cryptographic methods.

Related Content:

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Article source: https://www.darkreading.com/iot/post-quantum-crypto-standards-arent-all-about-the-math/d/d-id/1333892?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 16/02/2019
  • adm

Well Holby damned! We’ve caught a virus: Brit medical soap operas team up for ‘cyber’ episode

BBC “sister” medical drama shows Holby City and the venerable Casualty from which it sprang have announced that they are teaming up for a two-part “cyberattack special”. NHS techies, stop sniggering at the back!

Auntie has promised: “The various storylines will include a car crash, a possible pregnancy and two members of staff will find their life in the balance, with only one theatre available in the blackout [because of the cyberattack? – Ed].”

As those who’ve caught an episode or two will know, the best part of Casualty is guessing which of the extras in the opening scene are going to be the one that “gets it”. Is it the field trip of schoolkids gone bowling, guttered by a rogue bowling pin… the man on the roof with the protective goggles he doesn’t need, the unsuspecting senior pottering about below, whom he’s poised to crush when he falls off the ladder? Or will it be a recovering victim whose hospital bed guardrail malfunctions, thus depositing the patient to the floor with a thud whereupon they swiftly perish? (This was a real storyline.) Of course this event will involve something cybery. Where’s MalwareTech when you need him?

Let us know what you think in our handy poll, or weigh in in the comments below.

Pass the popcorn and HACK the PLANET! hospital. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/02/15/holby_casualty_brit_medical_soaps/

  • 15/02/2019
  • adm

Post-Quantum Crypto Standards Aren’t All About the Math

The industry needs to keep in mind the realities of hardware limits and transitional growing pains, according to Microsoft, Utimaco researchers.

The race for developing post-quantum cryptographic standards is well underway. Already the brightest minds in cryptographic research are in the middle of duking it out to decide what the best methods will be to make sure encrypted secrets stay safe from the brute-force computing power of quantum computers.

As experts explain, quantum computers will very soon render most of today’s advanced cryptographic methods obsolete. The window of when that will realistically happen is up for debate, but recent developments, such as IBM’s release of its first commercial quantum computer last month, show that it’s definitely on the foreseeable horizon. 

“There’s a huge transition that we’re facing,” says Dr. Brian LaMacchia, a distinguished engineer and head of the Security and Cryptography Group at Microsoft Research. “[It’s] bigger than the transition from MD5 to SHA-1 hash functions or SHA-1 to SHA-2 because we effectively need to upgrade everything that uses public key cryptography before the advent of quantum computers.”

Even if quantum computers don’t proliferate until 2030, that’s not a whole lot of time to account for a cryptographic transition like this, he says. That is why NIST is running a competition among academics to test and prod different theoretical ways to solve the post-quantum cryptography problem. It has been going for a little over a year now, and recently it whittled down proposed methods by more than half. LaMacchia’s team at Microsoft submitted four different methods, all of which are among the remaining 26 proposals.

As the competition kicks into its next phase, LaMacchia and others, including Avesta Hojjati, head of DigiCert Labs, say the industry needs to be mindful of the complete picture of how encryption is applied today as they make decisions for the post-quantum world. The math is only part of the equation, they explain. Researchers and security architects also need to be mindful of how a proposed solution is going to work within the limitations of where hardware and software stacks are going in the coming decades. 

In particular, they’ll need to think about the encryption of widespread Internet of Things (IoT) devices, many of which will require researchers to consider two major factors: lifespan and compute limitations.

“IoT devices are widely used, and they have a very long life cycle after they’re deployed,” Hojjati says. “You can imagine a sensor that will be deployed in an ocean to collect information about climate change will probably reside in that ocean for the next 20 to 60 years, and that sensor requires some kind of security.”

Not only are IoT devices long-lived, but they’re often completely integrated into expensive equipment that has physical safety implications. Take cars, for instance, which have tons of IoT devices built into their controller units. The point is that the expense will be very high for organizations to change out cryptographic methods on these kinds of devices once they’re in the field. That means researchers need to get it right out of the gate.

“Of all of the quantum-resistant algorithms that are currently under consideration, none of them actually has the performance and key size characteristics combined that something like RSA does. So either it takes you longer to do the key setup or a key encryption, or the public key is significantly larger, or the amount of data you have to transfer is significantly larger than what we’re used to,” LaMacchia says. “You actually want to test this out now to figure out whether or not your engineering is going to be able to handle the larger key sizes or whatever the performance characteristics come of whatever eventually gets standardized. It’s important to make sure you don’t have an implicit limitation somewhere in your software stack.”

This was the rationale behind recent testing that LaMacchia’s and Hojjati’s teams conducted with Utimaco to see whether one of Microsoft’s algorithms would play nicely with certificates issued by DigiCert and used with Utimaco Hardware Security Modules.  

Moving forward, additional methods will be needed that generally smooth the transition to quantum safe cryptography without compromising the security or stability of existing encryption applications, LaMacchia says. This is going to take a hybrid approach, he adds, as the community proves out the quirks and limitation of these new cryptographic methods.

Related Content:

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Article source: https://www.darkreading.com/iot/post-quantum-crypto-standards-arent-all-about-the-math/d/d-id/1333892?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 15/02/2019
  • adm

ICS/SCADA Attackers Up Their Game

With attackers operating more aggressively and stealthily, some industrial network operators are working to get a jump on the threats.

The bad news: Attacks aimed at industrial sites have become more aggressive over the past year. The good news: Some industrial control systems (ICS) operators increasingly are taking more proactive defensive measures to thwart cyberattacks on their networks.

“The threats are getting worse,” says Robert M. Lee, CEO and co-founder of Dragos, whose company this week published its annual findings on ICS threats and engagements with its industrial clients in 2018. “But people are being really proactive about this. And maybe it’s not communitywide and we have to reach more, but you’ve got some real forward-leaning companies that are pushed into the right direction.”

In nearly 40% of the incident response (IR) engagements conducted by Dragos in 2018, the attacker had been inside the network for more than a year. About one-fourth of its IR engagements were to determine whether a cyberattack was the cause of an outage or other event.

“We’re seeing major industrial instances today that are at least asking the question” of whether it was a cyberattack, Lee notes. “And that is a major step forward for those players.”

Even so, only about 20% to 30% of ICS organizations in North America today use real-time network monitoring to detect and thwart attacks, according to Lee. That’s the main security best practice recommended for ICS/SCADA organizations, and North America is actually ahead of other regions in adopting it.

Most of Dragos’ client work in 2018 was for proactive threat hunting and better mapping of network infrastructures: Thirty-three percent of all engagements were IR cases, while the rest were mainly threat analysis, assessments, and some tabletop exercises.

IT-OT Weak Link
One of the easiest ways to infiltrate an industrial network is via its IT infrastructure, and that’s a common initial attack vector. Gaining a foothold via a successful phish and user account compromise, for example, gives the attacker a better shot at gaining access to systems on the ICS network.

“Not much has changed in the last year” in ICS attack trends, says David Weinstein, vice president of threat research at industrial security firm Claroty. “In the past two to three years, we’ve seen attackers take advantage of exploiting the OT-IT convergence … it’s most efficient to leverage IT to get to OT, which wasn’t always the case. In the past, things were more isolated.”

Dragos’ Lee says his firm sees more hacking teams than ever targeting industrial networks. “We’re seeing wider sets of data, tradecraft, and lots more victims.”

The biggest shift is their using so-called “living off the land” methods, though not in the same way attackers operate in IT networks. It’s not their using Remote Desktop Protocol (RDP)-type attacks, for example, but instead employing native industrial protocols, Lee says. “These are things enterprise security would not detect,” he says.

Most of the ICS threat groups Dragos tracks use these types of camouflaging methods, and they also are beginning to employ legitimate penetration testing tools like Mimikatz, Metasploit, and PowerShell Empire.

Ongoing Patching Conundrum
Meanwhile, to patch or not to patch remains the big question for many industrial organizations as the number of ICS vulnerability discoveries and patches rose last year. Unlike in IT, applying a patch to an OT system can sometimes be more destructive and riskier than forgoing the update if it disrupts operations.

“You have to have an understanding of how adversaries are using these [vulns] and have a risk-based [patching] approach,” Lee notes.

Dragos analyzed some 204 public ICS vulnerabilities in 2018 and found that 82% had no direct interaction with an ICS system. Lee says that’s because most vulnerability research isn’t focused on ICS system vulns. Some 34% of network-exploitable flaws patched disclosed last year were ICS-based; the rest were typical IT protocols, like HTTP and FTP. Lee says that’s likely because of a lack of ICS knowledge by researchers, as well as a lack of tools for testing ICS protocols.

But big picture-wise, more than half of the vulns found last year in ICS systems could be used for dangerous cyber activity: “They could be leveraged for loss of view and control,” Lee says. Dragos also found that much of the mitigation advice in the vuln advisories was insufficient or outright inaccurate.

Reality Check
Some 72% of ICS vulnerability advisories in 2018 encompassed engineering workstation systems, human machine interfaces (HMIs), and industrial networking components, according to Dragos’ data. And those findings are a bit redundant, according to its analysis, because they already are easy marks without employing exploits.

“Most of these protocols are insecure by design,” Lee explains. “If the vulnerability is giving me privilege escalation on an HMI, why should I care when the default state of the HMI is already running in admin mode … the vulnerability [there] never needs to be used by the adversary.”

Related Content:

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise … View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/ics-scada-attackers-up-their-game/d/d-id/1333893?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 15/02/2019
  • adm

Hackers Found Phishing for Facebook Credentials

A “very realistic-looking” login prompt is designed to capture users’ Facebook credentials, researchers report.

A recently spotted phishing campaign is seemingly intended to steal victims’ Facebook login credentials with a fake pop-up prompt designed to look like a legitimate login portal.

Researchers with Myki, a password management company, were alerted to the threat when users complained the tool wasn’t auto-completing passwords on popular websites as usual. Upon investigation, the researchers began to think users were being deceived via malicious websites.

“The attack is based on the concept of being able to reproduce a social login prompt in a very realistic format inside an HTML block,” says Myki co-founder and CEO Antoine Vincent Jebara. The status bar, navigation bar, shadows, and content are reproduced to look like a real prompt.

When victims visit a malicious site, they are asked to authenticate using a social media account – in this case, Facebook. When they choose a login method, the site displays a fake login prompt. Users who fill in their credentials will automatically send their information to attackers.

Jebara recommends a quick check to test for fraudulent pop-up windows: Try to drag the pop-up away from the window it is displayed in, he advises. If dragging it out fails and part of the pop-up disappears beyond the edge of the window, it’s a sign the pop-up is fake.

Read more details here.

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/hackers-found-phishing-for-facebook-credentials/d/d-id/1333896?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 15/02/2019
  • adm

Staffing Shortage Makes Vulnerabilities Worse

Businesses don’t have sufficient staff to find vulnerabilities or protect against their exploit, according to a new report by Ponemon Institute.

For enterprise IT groups, responding to the volume of new vulnerabilities is growing more difficult – compounded by a chronic lack of skilled cybersecurity professionals to deal with the issues.

That is one of the major conclusions reached in a new report, “Challenging State of Vulnerability Management Today: Gaps in Resources, Risk and Visibility Weaken Cybersecurity Posture,” published by Ponemon Institute and sponsored by Balbix.

When asked about the difficulties of maintaining an adequate security posture, 68% of the more than 600 cybersecurity professionals surveyed listed “staffing” as a primary issue. These staffing shortages don’t exist exclusively at small organizations, either, with 72% of those surveyed from organizations with more than 1,000 employees.

With that shortage, just how confident are these professionals about avoiding future breaches? Not very. Only one-third of respondent said they were “confident” or “very confident” their organizations will be able to avoid a data breach.

Read more here.

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/staffing-shortage-makes-vulnerabilities-worse/d/d-id/1333897?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 15/02/2019
  • adm

Should we profit from the sale of our personal data?

You are worth $7.37 to Facebook. You are worth $2.83 to Twitter. You are worth 30 cents to Reddit.

Dagnabbit, it’s time to cash in!

That’s the cry from newly minted California Governor Gavin Newsom, who, in delivering his first state of the state address on Tuesday, said it’s time for the state’s consumers to get a cut of the profit tech companies are making by selling users’ personal data.

He asked his aides to cook up a proposal for a “data dividend” to enrich the financial portfolios of California residents, but he gave no hint as to how that might work. Would Twitter cut each user a check? Would Facebook be hit up with a new tax?

We’ll have to wait and see, but in the meantime, Newsom said, these tech giants are rolling in data-derived dough:

Companies that make billions of dollars collecting, curating and monetizing our personal data have a duty to protect it. California’s consumers should also be able to share in the wealth that is created from their data.

Earlier this week, our worth to social media networks was estimated by Axios, which got to those you-are-worth-pennies estimates by pretty much just dividing the platforms’ annual revenues by their numbers of monthly active users.

And when I say “you,” I mean, of course, your data… at least, if you’re an American. That is, after all, where the social networks fetch top dollar – or top penny, as the case may be – in exchange for offering us up for targeted marketing.

Newsom’s “pay us!” cry is only the latest in a post-Cambridge Analytica political clamor for tech giants to get more transparent about data handling – a clamor that’s included, as one example, Senator Ron Wyden’s proposal that company bosses should face jail time and massive fines for mishandling our privacy.

Jim Steyer, the founder and CEO of the nonprofit organization Common Sense Media, says that the idea to pay users for their personal data came from him. Common Sense, a powerful advocacy and media education player, is now working on related legislation. Fortune quoted Steyer:

While platforms are fast and loose with consumer data, they are not so willing to share what they are doing with the data or how much they are profiting.

We fully support the governor’s data dividend proposal and expect to introduce legislation that reflects that in the coming weeks.

Steyer has experience with drafting pro-privacy legislation: Common Sense Media helped pass California’s powerful digital privacy law – the California Consumer Privacy Act – last year.

There’s a big difference in that European-style privacy law – which grants Californians the right to control what’s collected, by whom and to what end; to forbid the sale or sharing of their data; and to hold businesses responsible for safeguarding the data – and the notion that we should cash in on its use.

Senator Mark Warner, of Virginia, has also been talking with Steyer. Following a chat with Steyer, Warner described California’s proposal to get back some of the data-derived profits by saying that it would involve getting users back 25% of their data’s value.

How that figure would be calculated isn’t clear, though Warner’s apparently working on that piece of the puzzle: Warner’s office told AP News on Wednesday that the senator is considering federal legislation requiring companies like Facebook and Google to give users annual estimates of what their data is worth.

Selling our data “will make the problem worse”

Not everybody thinks Newsom’s plan is a good one. AP News quoted Jeffrey Chester, executive director of the Center for Digital Democracy, who said that selling our data isn’t the way to protect consumer privacy:

[Consumers] shouldn’t be tricked into giving away their privacy for a small discount. Selling it for a few bucks isn’t the answer and will make the problem worse.

Were some type of profit-sharing to come via way of a new tax, consumers would likely see a “pittance of a benefit,” according to Dan Goldstein, president of the digital marketing agency Page 1 Solutions.

At the very least, though, the idea “highlights the value of data,” noted Democratic Assemblyman Ed Chau, chairman of the Assembly Committee on Privacy and Consumer Protection. As it is, data has often been described as the “new oil in this technological data-driven economy,” AP News quoted him as saying.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/ZVQRb5iWbxo/

  • 15/02/2019
  • adm

Judge won’t unseal legal docs in fight to break Messenger encryption

On Monday, a federal judge ordered that legal documents about the government’s fight to force Facebook to break Messenger encryption will be kept secret, Reuters reports.

In doing so, the judge denied motions from the American Civil Liberties Union (ACLU), the Washington Post and other groups that sought to unseal a federal court’s order to force Facebook to wiretap Messenger conversations, which are encrypted end to end.

The case concerned encrypted voice conversations. Investigators wanted to listen in on the conversations as part of an investigation into MS-13, a violent international gang that originated in Los Angeles. The law had already been listening in on ordinary phone calls and Messenger texts between the alleged gang members, but there were reportedly three Messengers calls that they couldn’t hear.

Reuters reports that the suspects on those calls were arrested anyway.

Spokespeople for the ACLU and the DOJ declined to comment, and Facebook’s arguments are sealed. However, US District Judge Lawrence O’Neill, in Fresno, California, reportedly wrote that Facebook was in favor of unsealing the documents, while the DOJ was not.

Judge: The legal reasoning would be too revealing

On Monday, Judge O’Neill sided with the Feds, ruling that the legal documents describe law enforcement techniques that are too sensitive to be successfully redacted without blowing the Feds’ investigations – whether it’s this particular, ongoing case or future investigations:

The materials at issue in this case concern techniques that, if disclosed publicly, would compromise law enforcement efforts in many, if not all, future wiretap investigations.

This salvo in the war against encryption has been kept far more quiet than the FBI’s loud attempts to backdoor Apple’s iPhone encryption in the case of the San Bernardino terrorists.

Keeping under the radar is in keeping with how the US conducts surveillance, the ACLU says, but it’s not in keeping with the public’s right to know, and to weigh in on, how it’s being surveilled.

ACLU: US has a “track record of hiding” surveillance

The ACLU and other rights groups argue that the public has a right to know the legal reasoning that decided the case – most particularly when it concerns the government’s secretive surveillance programs:

What is clear is that the public has a right to know the legal reasoning that decided this case – namely, what authority the Justice Department thought it had to force Facebook to undermine its security infrastructure and why the court determined that the government was wrong. This need for transparency is especially true when it comes to surveillance, where the government has a track record of hiding from public oversight.

The decision to keep the legal documents secret is a win for the Feds, but it follows a loss in the bigger battle to break encryption. In September, Facebook won this battle when a federal judge ruled that the government couldn’t force it to break Messenger’s end-to-end encryption.

In August 2018, the Department of Justice (DOJ) had reportedly tried to hold Facebook in contempt after it refused to enable the wiretapping. According to Reuters’ sources, Facebook had argued that in order to comply, it would need to rewrite Messenger’s code and undermine its security infrastructure for all users.

But again, all of these arguments are under seal. Given Monday’s ruling, it will stay that way.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/lPa8RRHEhzQ/

  • 15/02/2019
  • adm

Apple fighting pirate app developers, will insist on 2FA for coders

Remember how the world’s biggest social network got into trouble with Apple recently over an app called Facebook Research?

The app wasn’t designed for general use – in fact, Facebook couldn’t make it openly available to everyone because it was too snoopy to be allowed in the App Store.

Amongst other things, it peeked into some or all of the network traffic from your other apps, with the goal of improving Facebook by learning more about how people behaved online.

Keeping low-level tabs on what other apps are up to isn’t permitted in regular iPhone software, so Facebook got around these restrictions by offering the app in a limited-access version under Apple’s Enterprise Certificate programme.

That’s the system that businesses can use to write, build and digitally sign apps for their own staff without waiting for Apple to sign the app into the App Store first.

Simply put, it’s the closest thing that Apple has to Google’s “allow apps from unknown sources” option in Android, and it’s the only way, short of jailbreaking, to install software on an iPhone without going to the App Store.

Apple, to put it mildly, was not amused – companies are supposed to use the Enterprise Certificate programme to create internal apps for use by employees only.

Offering customers $20 for helping out was not enough to make them “employees”, at least in Apple’s opinion, and Facebook was forced to withdraw the Research app.

It soon turned out that Facebook weren’t the only ones stretching the meaning of “employee”, with Google’s Screenwise Meter app falling similarly foul of Apple’s guidelines.

Google paid you with gift cards rather than in regular dollars, and it pulled its app proactively rather than waiting for Apple to fire a shot across its bows, but the end result was the same: the app isn’t available any more.

Footloose and fancy free

Guess who else has been playing footloose and fancy free with Developer Certificates?

“Alternative vendors”, that’s who.

We’ve already written about how porn and gambling apps are offering off-market iPhone software using developer certificates.

Now, Reuters has identified another sector taking advatange of enterprise cover, namely software pirates.

According to Reuters, a bunch of “alternative suppliers” have been using developer certificates to sign unofficial, illegal versions of mainstream apps such as Spotify, Angry Birds, Pokemon Go and Minecraft.

Unofficial apps can be hacked to operate in ways neither Apple nor the official app creator would permit, such as removing ads, bypassing login and account restrictions, and – to put it bluntly – cheating in online games.

As Reuters notes, Apple can not only cancel certificates that have been abused, but also throw rogue developers out of the Developer Programme altogether, and there’s a fee and a waiting time to reapply.

2FA coming soon

There’s more that Apple can do, however, and it’s going to start doing it soon.

Apple will be insisting that programmers with Developer Certificates must use 2FA (two-factor authentication) as part of the responsibility that goes with the privilege.

We assume this will allow Apple much greater control over the abuse of compromised Developer Certificates – a crook who steals your password will no longer have enough information to access your account and sign apps with your certificate.

Enforcing 2FA could also make it tougher for rogue developers to fire up new accounts as their old ones get shut down.

2FA codes that are sent to your phone can be tied to the SIM, to the device or to both, making it harder to re-register for new accounts with phones that have already been busted for previous offences.

However, given that we’ve seen photos of iPhone “click farms” with thousands of devices in racks pretending to be thousands of unique, independent, genuine users, we do find ourselves wondering how much of a deterrent this will be to determined fraudsters.

Getting serious

Ironically, getting more serious about 2FA isn’t popular with everyone – an Apple customer in California is trying to kickstart a class action lawsuit claiming that Apple has “forced” him to use 2FA, and this has caused him and “millions of similarly situated consumers” to suffer “economic losses”.

And in a counter-irony that would be amusing if it didn’t paint such a dismally confused picture of the world’s relationship with cybersecurity, Google’s Nest division came under fire recently when a Nest user whose home was hacked publicly demanded a $4000 refund because Google hadn’t told him about 2FA.

For the record, neither of them received much sympathy from Naked Security readers.

Simply put, many of our readers generally seem to think that 2FA isn’t that hard; doesn’t take as much effort or cause as much trouble as its detractors claim; has a largely positive outcome for the law-abiding community; and is something that we should all be aware of by now, even if we ultimately choose not to bother with it.

What say you?

Where do you stand on 2FA?

Will Apple make a dent in rogue apps by insisting developers use 2FA, or should it leave it to the developers to make their own minds up?

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/Vm3mFK570HU/

  • 15/02/2019
  • adm

Holby damned! We’ve caught a virus: Brit medical soaps team up for ‘cyber’ episode

BBC “sister” medical drama shows Holby City and the venerable Casualty from which it sprang have announced that they are teaming up for a two-part “cyberattack special”. NHS techies, stop sniggering at the back!

Auntie has promised: “The various storylines will include a car crash, a possible pregnancy and two members of staff will find their life in the balance, with only one theatre available in the blackout [because of the cyberattack? – Ed].”

As those who’ve caught an episode or two will know, the best part of Casualty is guessing which of the extras in the opening scene are going to be the one that “gets it”. Is it the field trip of schoolkids gone bowling, guttered by a rogue bowling pin… the man on the roof with the protective goggles he doesn’t need, the unsuspecting senior pottering about below, whom he’s poised to crush when he falls off the ladder? Or will it be a recovering victim whose hospital bed guardrail malfunctions, thus depositing the patient to the floor with a thud whereupon they swiftly perish? (This was a real storyline, we are told.) Of course this event will involve something cybery. Where’s MalwareTech when you need him?

Let us know what you think in our handy poll, or weigh in in the comments below.

Pass the popcorn and HACK the PLANET! hospital. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/02/15/holby_casualty_brit_medical_soaps/

  • 15/02/2019
  • adm