hacking – Page 497 – STE WILLIAMS

Trakt app users’ personal data exposed: We were hit by a ‘PHP exploit’… back in 2014

library
crime | hacking | security

Trakt, the makers of an app that monitors users’ TV programme and movie viewing habits, has ‘fessed up to falling victim to a PHP exploit more than four years ago that resulted in data leakage.

The company has written to customers revealing it “learned of a data breach that occurred back in December 2014. The breach involved some of our personal information, such as user name, email and encrypted password.”

“Although this happened in 2014 we only recently discovered this, and wanted to promptly provide notice as part of our commitment to your privacy,” the email added.

The “good news”, Trakt told paying customers (the basic app is free), is that payment information was not included in the security wobble – that data is held by payment processors, rather than within its own servers.

But the data “lost” included email, usernames, encrypted passwords, names as well as customers’ “location”.

By January 2015, the business said it had moved from version 1 of its site to version 2 and “[i]n doing so, we removed any access outsiders had to your information”.

This shift led to a “more secure algorithm for storing passwords”, the platform change “removed the exploit” and the fresher infrastructure had “far tighter restrictions”, Trakt claimed.

It has reset passwords for affected users, sending an email with a reset link. Presumably the same email address that was leaked. And Trakt assured customers: “We are diligently monitoring our site.”

A probe into the leak is ongoing “but we believe a PHP exploit was used to capture data from Trakt users”.

“We know you trust us with your data and we failed to protect it. We’re incredibly sorry that this happened and hope that you’ll let us earn you trust back,” the email concluded. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/02/07/trakt_hit_by_php_exploit_in_2014_app_users_deets_explosed_but_thankfully_payment_info_not_part_of_the_data_leak/

Master the Latest Exploits and Security Vulnerabilities at Black Hat Asia

library
crime | hacking | security

In cybersecurity it pays to stay on top of the latest exploits, and there’s no better place to do that than Black Hat Asia in Singapore next month.

Any system built by humans can be exploited by humans, and in cybersecurity it pays to stay on top of the latest exploits. A great way to do that is to come to Black Hat Asia in Singapore next month, where security experts from around the world will show you how to pull off (and combat) cutting-edge exploits in modern browsers and operating systems.

Notably, researchers from the Tencent Security Xuanwu Lab will present a Briefing on “Attacking Browser Sandbox: Live Persistently and Prosperously” that offers you fresh perspective on the practical value and best methods of attacking modern browser sandboxes.

Despite their perceived impenetrability, security researchers have succeeded in doing things like stealing credentials and deploying side-channel attacks without disrupting the sandbox in browsers like Chrome, Edge, and Firefox — but you’ll have to attend this Briefing to find out how they pulled it off.

Speaking of Edge, there’s also a very focused Briefing on “Using the JIT Vulnerability to Pwn Microsoft Edge” that aims to give you a complete demonstration of how to attack vulnerabilities in Microsoft’s browser using the JIT (Just-In-Time) JavaScript compiler. Tencent security researchers will show you a full exploit demo (possibly via a zero-day vulnerability) and how to write your own. Don’t skip it!

“Winter is Coming Back: Defeating the Most Advanced Rowhammer Defenses to Gain Root and Kernel Privileges” promises to reveal a novel exploit capable of cracking the most advanced defense against rowhammer attacks. Whether you’re trying to defend against rowhammers or work out your own novel version, this Briefing will show you how an unprivileged user application can gain both root and kernel privileges — all while being stealthier and more efficient than traditional rowhammer attacks.

Finally, don’t miss “How to Survive the Hardware Assisted Control-Flow Integrity Enforcement”, in which McAfee researchers will take you on a deep dive into the Intel CET (Control-flow Enforcement Technology), how it works against control-flow hijacking, and its implementation on the latest Windows 10 x 64 operating system. They’ll discuss possible ways to still achieve control-flow hijacking when CET is enabled and provide demonstrations for the attacks discussed.

Black Hat Asia returns to the Marina Bay Sands in Singapore March 26-29, 2019. For more information on what’s happening at the event and how to register, check out the Black Hat website.

Article source: https://www.darkreading.com/black-hat/master-the-latest-exploits-and-security-vulnerabilities-at-black-hat-asia/d/d-id/1333814?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

DDoS Mitigation Pioneer Launches Network Security Startup

library
crime | hacking | security

Barrett Lyon is co-founder of Netography, which emerged today with $2.6M in seed funding from Andreessen Horowitz.

Netography, a new autonomous network security platform, today emerged with $2.6 million in seed funding from Andreessen Horowitz. The startup aims to leverage real-time data from network devices to help security and network teams automatically block malicious traffic.

Co-founders are DDoS mitigation pioneer Barrett Lyon as CEO and Dan Murphy as CTO. Lyon, known for his work in anti-DDoS and network security tech, has also founded Prolexic, acquired by Akamai; BitGravity, acquired by Tata Communications; XDN, acquired by Fortinet; and Defense.net, acquired by F5 Networks.

“No one understands networks, how they act, the information they provide, and how to protect them better than Barrett and his team,” said Martin Casado, general partner at Andreessen Horowitz and software-defined network expert, in a statement on the news.

Netography’s platform, to be released in the second quarter of 2019, collects data from enterprise network devices and applies cloud processing, software, and algorithms to identify and block threats that are normally difficult to detect. The idea of “capture everything” is in the past, said Lyon in a release. Netography aims to remotely solve problems that first-generation network traffic analyzers, DLP, and SIEM tools have struggled to address in the past.

When 911 Goes Down: Why Voice Network Security Must Be a Priority

library
crime | hacking | security

When there’s a DDoS attack against your voice network, are you ready to fight against it?

An estimated 240 million calls are made to 911 in the US each year. With the US population estimated at more than 328 million people as of November 2018, this means each US resident makes, on average, more than one 911 call per year. 911 is a critical communications service that ensures the safety and individual welfare of our nation’s people.

So, what happens when the system goes down?

Unfortunately, answers can include delays in emergency responses, reputational damage to your brand or enterprise by being associated with an outage, and even loss of life or property. We have seen very recent examples of how disruption in 911 services can impact municipalities. For example, days after Atlanta was struck by a widespread ransomware attack, news broke of a hacking attack on Baltimore’s computer-assisted dispatch system, which is used to support and direct 911 and other emergency calls. For three days, dispatchers were forced to track emergency calls manually as the system was rebuilt — severely crippling their ability to handle life-and-death situations.

In 2017, cybersecurity firm SecuLore Solutions reported that there had been 184 cyberattacks on public safety agencies and local governments within the previous two years. 911 centers had been directly or indirectly attacked in almost a quarter of those cases, most of which involved distributed denial-of-service (DDoS) attacks.

Unfortunately, these kinds of DDoS attacks will continue unless we make it a priority to improve the security of voice systems, which remain dangerously vulnerable. This is true not just for America’s emergency response networks, but also for voice networks across a variety of organizations and industries.

The Evolving DDoS Landscape
In today’s business world, every industry sector now relies on Internet connectivity and 24/7 access to online services to successfully conduct sales, stay productive, and communicate with customers. With each DDoS incident costing $981,000 on average, no organization can afford to have its systems offline.

This is a far cry from the early days of DDoS, when a 13-year-old student discovered he could force all 31 users of the University of Illinois Urbana-Champaign’s CERL instruction system to power off at once. DDoS was primarily used as a pranking tool until 2007, when Estonian banks, media outlets, and government bodies were taken down by unprecedented levels of Internet traffic, which sparked nationwide riots.

Today, DDoS techniques have evolved to use Internet of Things devices, botnets, self-learning algorithms, and multivector techniques to amplify attacks that can take down critical infrastructure or shut down an organization’s entire operations. Last year, GitHub experienced the largest-ever DDoS attack, which relied on UDP-based memcached traffic to boost its power. And just last month, GitHub experienced a DDoS attack that was four times larger.

As these attacks become bigger, more sophisticated, and more frequent, security measures have also evolved. Organizations have made dramatic improvements in implementing IP data-focused security strategies; however, IP voice and video haven’t received the same attention, despite being equally vulnerable. Regulated industries like financial services, insurance, education, and healthcare are particularly susceptible — in 2012, a string of DDoS attacks severely disrupted the online and mobile banking services of several major US banks for extended periods of time. Similarly, consider financial trading — since some transactions are still done over the phone, those jobs would effectively grind to a halt if a DDoS attack successfully took down their voice network.

As more voice travels over IP networks and as more voice-activated technologies are adopted, the more DDoS poses a significant threat to critical infrastructure, businesses, and entire industries. According to a recent IDC survey, more than 50% of IT security decision-makers say their organization has been the victim of a DDoS attack as many as 10 times in the past year.

Say Goodbye to DDoS Attacks
For the best protection from DDoS attacks, organizations should consider implementing a comprehensive security strategy that includes multiple layers and technologies. Like any security strategy, there is no panacea, but by combining the following solutions with other security best practices, organizations will be able to better mitigate the damages of DDoS attacks:

Traditional firewalls: While traditional firewalls likely won’t protect against a large-scale DDoS attack, they are foundational in helping organizations protect data across enterprise networks and for protection against moderate DDoS attacks.
Session border controllers (SBCs): What traditional firewalls do for data, SBCs do for voice and video data, which is increasingly shared over IP networks and provided by online services. SBCs can also act as session managers, providing policy enforcement, load balancing and network/traffic analysis. (Note: Ribbon Communications is one of a number of companies that provide SBCs.)
Web application firewalls: As we’ve seen with many DDoS attacks, the target is often a particular website or online service. And for many companies these days, website uptime is mission-critical. Web application firewalls extend the power of traditional firewalls to corporate websites.

Further, when these technologies are paired with big data analytics and machine learning, organizations can better predict normative endpoint and network behavior. In turn, they can more easily identify suspicious and anomalous actions, like the repetitive calling patterns representative of telephony DoS attacks or toll fraud.

DDoS attacks will continue to be a threat for organizations to contend with. Cybercriminals will always look toward new attack vectors, such as voice networks, to find the one weak spot in even the most stalwart of defenses. If organizations don’t take the steps necessary to make voice systems more secure, critical infrastructure, contact centers, healthcare providers, financial services and educational institutions will certainly fall victim. After all, it only takes one overlooked vulnerability to let attackers in.

Related Content:

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

As Vice President of Product Management, Mykola Konrad leads Ribbon Communications’ global SBC, Analytics, and Security product portfolio. Mykola has 25 years of technology development and product management experience, most recently serving as Vice President of Marketing at … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/when-911-goes-down-why-voice-network-security-must-be-a-priority-/a/d-id/1333782?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Accused hacker Lauri Love to sue National Crime Agency to retrieve confiscated computing kit

library
crime | hacking | security

Lauri Love, the Brit who beat US attempts to extradite him over accusations of hacking, is suing Blighty’s National Crime Agency (NCA) to get back computing gear seized in 2013 as part of the case against him.

More than five years ago, Love was indicted across the pond over allegations he hacked thousands of PCs in America and other countries, inserting backdoors into networks with the aim of circling back at a later date to pilfer confidential data.

It was alleged Love had breached the security of NASA, the US military, and other government agencies. The following year, 2014, Uncle Sam added the Federal Reserve to that list.

Here’s how police arrested Lauri Love – and what happened next

Love, who has dual British and Finnish nationality, was arrested in late 2013 following a joint probe by the FBI and the NCA. He won a preliminary hearing in 2016 in which the NCA was ruled to have attempted to sidestep protections for encrypted data under the Investigatory Powers Act 2000 when it tried to to force him – via a RIPA notice – to disclose encryption keys and passwords for kit it seized from him in 2014.

Love was bailed in June 2016.

The case was then put on ice as Love battled extradition: efforts to haul him to court stateside ultimately failed in 2018, though a High Court beak urged British authorities to “bend their efforts” to pursue a UK prosecution.

Love and his legal team have since heard nothing in the intervening year, and now he is requesting the NCA return two PCs and several storage devices that allegedly contained encrypted data, using Police Property Act of 1897 legislation.

“As the NCA has not elected to pursue charges and has seemingly not put any effort into this end either before the commencement or since the conclusion of extradition proceedings, it has become unfortunately necessary to use the instruments handed down by Parliament for redress of arbitrary dispossession of individuals by executive bodies through the Police Property Act,” said Love.

He said the “responsibility” lies with the legal process to “fathom the issues, not least of which is whether it is acceptable that claims made about encrypted contents can overturn the default presumption that individuals, groups and entities can own property, and on whom rests the burden of proof regarding such claims.”

Love is representing himself in the civil action.

The NCA told us at the time of publication that it is drafting a statement. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/02/06/laurie_love_to_sue_national_crime_agency_uk/

It’s 2019, and a PNG file can pwn your Android smartphone or tablet: Patch me if you can

library
crime | hacking | security

Google has emitted security fixes for Android that should be installed, should you get the chance, as they can be potentially exploited to hijack devices.

The worst vulnerability in the latest monthly batch, according to the ad giant, is one in which a maliciously crafted PNG image could execute code smuggled within the file, if an application views it. Thus an evil .PNG file opened by a chat app or email reader, say, could start running malware on the device with high-level privileges.

Two other bad holes we can see are in Android’s handling of Bluetooth signals: a maliciously crafted transmission can execute arbitrary code on the device, according to Google.

“The most severe of these issues is a critical security vulnerability in Framework that could allow a remote attacker using a specially crafted PNG file to execute arbitrary code within the context of a privileged process,” Team Google warned this week.

“We have had no reports of active customer exploitation or abuse of these newly reported issues.”

Here’s a summary of the security fixes in February’s release bundle (bear in mind, only Android 7 to 9 receive security updates now):

Framework has three remote-code execution bugs, the worst of which can be pwned by a PNG file: CVE-2019-1986, affecting Android 9; CVE-2019-1987 affecting version 7.0, 7.1.1, 7.1.2, 8.0, 8.1, and 9; and CVE-2019-1988 affecting version 8.0, 8.1, 9.

Library has four flaws, the worst allowing code to run in a hacker-sent file when parsed: CVE-2017-17760 affecting version 7.0, 7.1.1, 7.1.2, 8.0, 8.1, and 9; CVE-2018-5268 affecting version 7.0, 7.1.1, 7.1.2, 8.0, 8.1, and 9; CVE-2018-5269 affecting version 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9; and CVE-2017-18009 affecting version 7.0, 7.1.1, 7.1.2, 8.0, 8.1, and 9.

All are remote-code execution holes, except CVE-2017-18009, which discloses information.

System has eight flaws, the worst involving remote-code execution with Bluetooth transmissions: CVE-2019-1991 affection versions 7.0, 7.1.1, 7.1.2, 8.0, 8.1, and 9; CVE-2019-1992 affecting versions 7.0, 7.1.1, 7.1.2, 8.0, 8.1, and 9; CVE-2019-1993 affecting versions 8.0, 8.1, and 9; CVE-2019-1994 affecting versions 8.0, 8.1, and 9; CVE-2019-1995 affecting versions 7.0, 7.1.1, 7.1.2, 8.0, 8.1, and 9; CVE-2019-1996 affecting versions affecting 8.0, 8.1, and 9; CVE-2019-1997 affecting versions 7.0, 7.1.1, 7.1.2, 8.0, 8.1, and 9; and CVE-2019-1998 affecting version 9.

CVE-2019-1991 and 1992 are remote-code execution flaws, 1993 and 1994 are elevation of privilege, 1995 to 1997 can be exploited to disclose sensitive information, and 1998 is a denial of service.

But wait, there’s more

On top of this, there are four Linux kernel flaws in Android (CVE-2018-10879, CVE-2019-1999, CVE-2019-2000, CVE-2019-2001) that can at worst be exploited by a dodgy application to gain higher privileges and hijack the device.

Nvidia’s drivers have four bugs (CVE-2018-6271, CVE-2018-6267, CVE-2018-6268, CVE-2016-6684) that can at worst be exploited by malicious programs commandeer a vulnerable device. And 19 security screw-ups in Qualcomm‘s drivers that range from high to critical severity.

If your Android device’s security patch level is dated February 2019, then you’re up to date. If not, then check for updates and install them – some may be available.

It’s up to your device manufacturer, and mobile carrier if appropriate, to approve and pass on fixes. Certain Google devices, primarily Pixel and older Nexus devices, get them directly from the ad giant, and its Play services can in some cases push patches straight to gizmos.

Also, there are defenses built into Android, such as ASLR, that may thwart exploit attempts. So far, no malware or miscreants are said to be targeting the flaws. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/02/07/android_january_patches/

Who are the last people you’d expect to spill thousands of student records? A computer science dept? What a fantastic guess

library
crime | hacking | security

An errant email leaked academic information on every student at the Cal Poly Pomona College of Science, in California.

University publication Poly Post reports that it was, of all people, the American school’s computer science department that was to blame for the exposure of 4,557 active student records in an email that got sent out to other students – and was later partially posted to the forums of Reddit.

The data leak occurred on January 28, when an administrator with the uni’s computer science department intended to send its 940 students each a separate email containing their individual academic records. It seems that, by accident, attached to that email was a spreadsheet containing the academic details of everyone in the college of science.

While there was no particularly sensitive information in this spreadsheet (i.e. social security numbers or home address), the spreadsheet did contain records including students’ current academic standing and their grade point average (GPA).

While the email was reportedly spotted and withdrawn less than an hour after it was sent, at least one of the students who received the email was able to save the information and post it to Reddit as an infographic.

“The University took immediate measures to delete the emails, but we cannot confirm whether any identifying information was downloaded or shared on platforms outside the University’s control,” the administration said in an email to students (the school provided a copy to The Register).

Q. What do you call an IT admin for 20-plus young children? A. A teacher

“All active students in the College of Science were notified of the incident the morning of January 29 and instructed to contact the Registrar’s Office regarding questions or concerns. The University has begun a comprehensive review of our practices regarding the sharing and accessing of personal information. Revisions to our policies and practices and other steps the University will be taking to ensure the privacy of information will be shared regularly with the campus community.”

That any information was leaked is bad enough, but for the leak to happen at the computer science department of Cal Poly, a noted science and engineering university, is – to say the least – highly embarrassing.

The incident is also leading security experts to question the school’s record-keeping and data security policies.

“Accidents happen, but you have to wonder why sensitive data was stored in a spreadsheet in the first place,” Stealthbits Technologies VP Martin Cannard said in a statement provided to El Reg.

“Perhaps data was exported for mail merge but any student information over and above what was required should have been removed as a matter of due diligence.”

Let this be a reminder: always, always, double-check before hitting the “send” button. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/02/07/cal_poly_leak/

At least Sony offered a t-shirt, says macOS flaw finder: Bug bounties now for Macs if you want this 0-day, Apple

library
crime | hacking | security

Vid The bloke who found a password-spaffing bug in macOS says he won’t divulge details on the flaw to Apple until the tech titan agrees to properly compensate vulnerability researchers.

Germany-based freelance bug-hunter Linus Henze says the security weakness can be exploited by malware and other dodgy apps running on a Mac to harvest passwords, private keys, and tokens from the victim’s keychain. Ideally, programs shouldn’t be able to snatch your Facebook or GitHub login details, for example. Here’s a video demonstrating the flaw on the most recent version of macOS:

Youtube Video

“In this video, I’ll show you a zero-day exploit that allows me to extract all your (local) keychain passwords on macOS Mojave, and lower versions,” Henze wrote in the vid description. “Without root or administrator privileges, and without password prompts, of course.”

While the vulnerability has been checked and verified by noted Mac security guru Patrick Wardle, after he obtained a copy of Henze’s exploit, details of the shortcoming are not publicly known – not even to Apple.

That’s because Henze is refusing to release any details on the vulnerability, especially to Cupertino, until Apple agrees to include macOS in the highly secretive invite-only bug bounty program it runs for the more popular iOS mobile platform.

Currently, Apple offers selected security researchers payments for reporting iOS vulnerabilities, but not for Mac operating system bugs. Henze wants to change that, and he’s using his latest zero-day finding as leverage.

“I won’t release this,” he said of his exploit code. “The reason is simple: Apple still has no bug bounty program for macOS, so blame them.”

Henze told The Register that he’s not doing this out of greed, but rather a desire to see himself and other macOS bug-hunters get the recognition from Apple that they deserve. He thus declined to name a price for the keyring vulnerability.

I won’t bother hunting and reporting more Sony zero-days, because all I’d get is a lousy t-shirt

“My motivation is to get Apple to create a bug bounty program. I think that this is the best for both Apple and researchers,” he told us.

“I really love Apple products and I want to make them more secure. And the best way to make them more secure would be, in my opinion, if Apple creates a bug bounty program, like other big companies already have.”

Henze is not alone in his frustration over lousy bug bounty programs. Just this week, the researcher who discovered a pair of critical flaws in Sony’s web applications told The Register that he declined to do further research into its websites because the electronics giant only rewards vulnerability reports with free clothing.

“But at least he got a t-shirt,” Henze quipped in reference to our earlier story. “Apple wants to give me nothing.”

Apple did not respond to a request for comment. According to their latest quarterly financial figures, Cook co. banked profits of $222m per day, every day. Chucking some of that money at researchers who save your fans’ bacon would, to some, seem a neat investment. But hey ho? ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/02/07/mac_0day_disclosure/

Attacks on Automotive Systems Feared Likely

library
crime | hacking | security

Yet few engineers feel empowered to do anything about them, a survey shows.

A new survey of engineers in the automotive industry reveals concerns about the security of systems in automobiles — and even more so about the processes in place for testing their security.

In fact, 84% of respondents said they have concerns that their cybersecurity practices aren’t keeping up with technology advances. The survey, sponsored by Synopsys and SAE International, and conducted by the Ponemon Institute, took responses queried nearly 600 engineering and associated professionals in the automotive industry about the security of their components and systems, as well as those of their partners.

Furthermore, 63% of advances said their organizations test less than half of the hardware, software, and other technology used in their products for security vulnerabilities.

As a result, 52% said a malicious or proof-of-concept exploit against a vulnerability in their organizations’ products is likely or very likely within the next 12 months. Unfortunately, less than one-third (31%) said they feel they are empowered to raise their security concerns.

New Chrome Extension Takes Aim at Password Security

library
crime | hacking | security

Google adds ‘Password Checkup’ feature that alerts users if their online credentials have been compromised.

A Google/Harris Poll released earlier this week on Safer Internet Day found that 52% of respondents reuse the same password for multiple – but not all – accounts, while another 13% reuse the same password for all of their accounts.

“When you take the two numbers together, you’re looking at 65% who use the same passwords for multiple accounts,” says Emily Schechter, product manager for Chrome security at Google.

As a result, Google this week released the Password Checkup extension for its Chrome browser, which warns users whether their credentials have been compromised. Web users can enable these new features by downloading the extension.

Wherever a user signs in, if the user name and password entered appears in a data breach known to Google, the person will receive an alert to reset the password. Password Checkup, developed in a partnership with Stanford University, was built with privacy in mind. According to Google, it never reports any identifying information about a user’s accounts, passwords, or devices. However, Google does report anonymous information about the number of lookups that surface an unsafe credential, whether an alert leads to a password change, and the domain involved for improving site coverage.

“We’ve developed technology that will alert you that the credentials are compromised without knowing what the credentials are,” Schechter says. “We’ll also only notify you about current user names and passwords. We gave this a lot of thought and want to avoid spamming people to the point where they get warning fatigue.”

The Google/Harris Poll also reveals that just 24% of those surveyed use a password manager, and 69% give themselves an A or B when it comes to protecting their online accounts.

Avivah Litan, a vice president and distinguished analyst who focuses on security at Gartner, says the low usage numbers for password managers are not surprising.

“Password managers are easy to use once you get it,” Litan says. “They can create more problems for users because all their passwords are now in one place. As of right now, they are too much for average users to manage.”

Frank Dickson, a research vice president in IDC’s Security Products research practice, thinks the industry needs to move toward eliminating the password.

“The average person handles something like 200 user names and passwords,” he says. “I think we are expecting a lot for people to manage all those passwords and change them every three months.”

Regarding the finding that 69% of respondents give themselves high marks on security, Gartner’s Litan says consumers are naïve.

“There are keyloggers out there all the time and serious security threats that are not visible to consumers,” Litan says. “Many think that they know how to look for phishing emails or they use a complicated password. … The NSA isn’t confident they can protect their online accounts, so how can consumers?”

Related Content:

Steve Zurier has more than 30 years of journalism and publishing experience, most of the last 24 of which were spent covering networking and security technology. Steve is based in Columbia, Md. View Full Bio

Article source: https://www.darkreading.com/endpoint/authentication/new-chrome-extension-takes-aim-at-password-security-/d/d-id/1333813?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple