STE WILLIAMS

Attempts to define international infosec rules of the road bogged down by endless talkshops, warn diplomats

FIC 2020 International progress on state-level so-called cybersecurity “norms” is hopelessly bogged down in an explosion of NGOs and internal United Nations rivalries between two overlapping groups, a French security conference heard this week.

Not only are there two overlapping United Nations groups tasked with defining international cybersecurity norms, but even agreed declarations are ignored because nobody notices what the UN comes up with on cybersecurity, diplomats complained.

Set in the context of a panel discussion about soft standards for states interacting in cyberspace, the discussion did not build confidence in the idea that countries will sign up to a worldwide set of rules on what is and isn’t acceptable online.

“Norms,” said Alex Klimburg of the Global Commission on the Security of Cyberspace (GCSC), a think-tank initiative, “are soft law. They’re agreements on the rules of the road in cyberspace.”

Speaking about two top-level UN cybersecurity groups – the Group of Governmental Experts (GGE) and the Open-Ended Working Group (OEWG) – Florian Escudié of the French foreign ministry warned that the two groups were descending into rival talking shops.

He told an audience at the Forum International de Cybersecurité (FIC 2020): “The main risk I can see is that we have a cliff between both: one group perceived as the group for the happy and the few, the GGE, with experts convening in a small group, addressing items that have been discussed for a very long time, and unable to come to a solution to those issues.”

As explained on the Geneva-based Digital Watch Observatory’s website, the GGE and the OEWG are all but competing directly against each other. While the GGE has 25 members, the OEWG features “all interested UN member states”. GGE experts’ backgrounds, all on stage in Lille this week agreed, slant towards ex-arms control wonks.

Praising the OEWG, Escudié continued: “One important area is, we should avoid at any cost easy solutions. [Let’s say a] Russian or Chinese [actor] drafts a new treaty. It sounds quite interesting – you know, ‘We have an international programme, we lack norms or they wouldn’t be directly applicable, let’s write a treaty.’ But face reality,” he said, stating that in his view the most important thing at UN level is “to make sure that there is no use of the cyber network to conduct malicious activities.”

States should not target other states’ Computer Emergency Response Teams – sounds pretty basic, right?

Klimburg of the GCSC said a previous set of cyber standards agreed by the UN General Assembly were “violated rather quickly”. Pointing out that this was “not a bad thing necessarily” (as he put it, “the violation helps understanding that the norm exists”), he lamented how the international cyber-norms his initiative was putting forward “are not taking root”.

A body he described as “the international CERT organisation” had, he said, “never heard of” the UN-agreed norm that states should not target other states’ Computer Emergency Response Teams, or CERTs. The term is interchangeable with Computer Security Incident Response Team (CSIRT).

Why was this? Klimburg asked. In his view, it was because it was “easy to violate” and there were “no records of violations”.

Liga Rozentale, Microsoft’s director of EU policy on cybersecurity, observed that the current setup seemed to be very much “government versus non-governmental actors” with both sides still uncertain about what needs to be defined as a norm and what is best left alone for now. Microsoft, she said, had come to the view that there needed to be “an independent organisation” working on this, and she pointed to the Cyber Peace Institute in Geneva, which she said was co-founded by Microsoft, as one example.

Although the world is a complex place, it seems there’s going to be little consensus in the immediate future on what countries should and should not accept online. And that probably suits the likes of North Korea, Iran, Russia and China just fine. ®

Sponsored:
Detecting cyber attacks as a small to medium business

Article source: https://go.theregister.co.uk/feed/www.theregister.co.uk/2020/01/31/un_cyber_norms_chaos_fic_2020/

  • 31/01/2020
  • adm

A year after Bank of Valletta ‘cyber heist’, cuffs applied as cash-cleansing case continues

Nearly a year after Malta’s Bank of Valletta (BOV) yanked itself from the internet amid a “cyber intrusion”, Britain’s National Crime Agency (NCA) has made three arrests.

Around £800k was transferred to a number of accounts during the 2019 “cyber heist”, according to the NCA, one of which was in the UK and held in Belfast.

In the hours after the funds arrived, cash withdrawals and card payments were made to the tune of £340k, with money spaffed over London stores such as Harrods and Selfridges, the NCA alleged. Approximately £110k was spent on Rolex watches while other payments were made for an Audi A5 and a Jaaaaaag before cops caught up and blocked the account.

The three arrests were made in Belfast and London and are part of an investigation into the laundering of money linked to last Feburary’s shenanigans.

The collars of two chaps, aged 22 and 17, were felt in London on 22 January (with a further man interviewed under caution) and a further two warrants were executed in Belfast yesterday, resulting in a 39-year-old being arrested on suspicion of money-laundering offences, fraud and theft.

The girls and boys in blue remain on the hunt for “a number of other suspects”.

UK Plod has been working with the Malta Police Force Economic Crime Unit, focusing on individuals suspected of being involved in laundering money on behalf of the gang that carried out the attack.

The 2019 attack saw miscreants use malware in an attempt to siphon nearly €13m from accounts holding bank funds. The panicked bank pulled the plug, but not before funds were transferred. The BOV was keen at the time to emphasise that customer funds were “in no way impacted or compromised” by the breach.

“Our investigation continues,” said NCA Belfast branch commander David Cunningham. ®

Sponsored:
Detecting cyber attacks as a small to medium business

Article source: https://go.theregister.co.uk/feed/www.theregister.co.uk/2020/01/31/bank_valletta_malta_cyber_heist_case_arrests/

  • 31/01/2020
  • adm

How To Keep Your Privacy and Data Secure While Working With a Remote Team

Implementing basic strategies can ensure your remote team’s work will be secure, data will be protected, and you’ll be far less exposed to security risks.

Working with a remote team comes with a laundry list of unique challenges and problems. Perhaps chief among these is ensuring that your data and information is kept secure.

Remote teams can now be stretched across the globe, operating out of different time zones, and often balancing their work with the unique lifestyle that often comes with remote work. In order to get their jobs done, they will require access to whatever accounts, documents, or data that will help them to work whenever they are able to. Even though there have been incredible advances in technology that make this a lot easier to manage, there are also incredible security risks that come with it.

With employees connecting to your business from different locations, the risk of a bad agent gaining access to your business, stealing information, and potentially planting malware is all too real. In many cases, it takes little more than an unsecured network to kick start this process.

To prevent this from happening to your business, here are some key steps you can take to keep your data secure while managing a remote team.

Read the full article here.

 

 

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/cloud/how-to-keep-your-privacy-and-data-secure-while-working-with-a-remote-team/d/d-id/1336917?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 31/01/2020
  • adm

How to Secure Your IoT Ecosystem in the Age of 5G

For businesses planning to adopt 5G, the sheer number of IoT devices creates a much larger attack surface.

The Internet of Things is becoming an integral part of business and daily life, affecting everything from monitoring products in a warehouse to tracking your heartrate and sleeping patterns. Gartner predicts that by the end of this year, 5.8 billion enterprise and automotive IoT endpoints will be in use. And now, with deployment of 5G on the horizon and the massive expansion of IoT devices, a new security challenge is emerging.

For businesses planning to adopt 5G, the sheer number of IoT devices creates a much larger attack surface. In a recent study by ATT Cybersecurity, 44% of respondents stated this was their top business concern when it comes to 5G, while 39% identified the increase in connected devices to the network as their top concern. The number of connection points to the network, human and machine, will create new opportunities for bad actors to weaponize currently known manageable threats. 

While 5G is inherently more secure with its built-in security measures (including network slicing, stronger over-the-air encryption, subscriber identity protection, and reduced risk of eavesdropping) to address many business needs, enterprises should be proactive in adjusting their security policies and controls. Here are four tips for organizations to keep their networks safe in this new 5G connected world.

Adopt virtualized, automated security controls 
This will help organizations manage the expanded attack surface and mitigate future risk. Virtualized security can be deployed quickly and allows organizations to respond immediately to new attacks with an automated response such as creating a firewall. 

Implement machine learning and threat detection
You’re going to need to be able to better monitor and analyze the increased amount of activity across your network. Machine learning and automated threat detection are necessary, since manual intervention will no longer be able to sift through and react to the amount of data 5G will bring.

Consider a zero-trust approach
Using zero trust for identity and authorization across all devices in your organization lowers the possibility of the introduction of malware on the network. By continually checking a user’s presence and behavior, a zero-trust model will help your security team quickly determine whether the user is human or machine.

Embrace a shared security model
IoT devices will continue to have vulnerabilities, such as factory-default passwords remaining in production, and organizations will need to take responsibility for safeguarding against rogue devices. Just as in the public cloud, a shared security model for 5G will help providers allow for security in the infrastructure by using the network itself as a security tool, while organizations tackle the endpoints.

In a shared security model, the enterprise would assume responsibility for devices on the network. And, with 5G, the network operator is responsible for the elements of security listed out in 3GPP frameworks and standards (i.e. data encryption and radio access network) as well as  handling the security of the network infrastructure itself, while the enterprise would assume responsibility for devices on the network including mobile device management, certification of applications that the enterprise runs on the network, and identity and access management.

With the influx of devices connected to 5G, adopting a holistic, multi-layered approach will be key to helping protect your IoT ecosystem and other valuable assets. Every organization’s IT and security infrastructure has a different design, which also means each organization’s security needs will differ. A factory floor, for example, that uses a number of industrial IoT devices to produce automobiles will have different security measures than a life-sensitive device, like an insulin pump, that is dependent on remediation and response plans. Even if someone is accessing the data, the device would not want to be disabled.

While there are controls to help prevent end devices from infecting carrier 4G networks, a single device has been known to impact enterprise networks. In 2018, hackers used a smart fish tank in a Las Vegas casino to access and move laterally throughout the network to steal 10 gigabytes of data. Anything that’s connected can be a weak link for hackers to gain entry to your network. Take a step back to look at how your IoT networks are connected to your traditional IT networks to determine how to segment them. This will help limit risks in an organization’s IoT ecosystem. 

5G is coming, and along with it is a stream of IoT devices and new technologies. But organizations must keep in mind that this means the attack surface is also going to expand significantly and increase opportunities for bad actors. Adopting a multi-layered approach, identifying the interconnectivity of devices and its physical environment, as well as deploying virtualization and automation among other defenses, will help to lessen risk and prepare organizations for the promises of IoT in a 5G world.

Related Content:

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Top story: “7 Steps to IoT Security in 2020.”

Theresa Lanowitz is a proven global influencer and speaks around the world on trends and emerging technology poised to help today’s IT organizations flourish. Prior to joining ATT Cybersecurity, she founded industry analyst firm voke, to highlight emerging technologies and … View Full Bio

Article source: https://www.darkreading.com/risk/how-to-secure-your-iot-ecosystem-in-the-age-of-5g/a/d-id/1336879?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 31/01/2020
  • adm

I’m an SMB. What Should I Watch for When Choosing Security Vendors?

SMBs need action, not just insight.

Question: I’m an SMB. What should I watch for when choosing security vendors and their products?

Alex Peay, senior vice president at SaltStack: Due to SMBs’ limited budgets, they need to make sure the solution they purchase not only identifies problems, but provides the ability to fix and validate those fixes. SMBs need action, not just insight, from their vendors so their security teams can be effective in closing risks and vulnerabilities.

One of the biggest forgotten costs with selecting a solution is talent. As the skills gap continues to grow (and become more expensive as a result), the importance of choosing a solution that can automate and simplify the administration of your infrastructure without vendor support also continues to grow. This will allow the smaller staff of an SMB to be more effective and efficient, which, in turn, will save time and money.

Related Content:

 

The Edge is Dark Reading’s home for features, threat data and in-depth perspectives on cybersecurity. View Full Bio

Article source: https://www.darkreading.com/edge/theedge/im-an-smb-what-should-i-watch-for-when-choosing-security-vendors/b/d-id/1336928?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 31/01/2020
  • adm

Russian Cybercrime Forum Contests Bring Cash, Visibility to Winners

Competitions for users are a long-time tradition on underground cybercrime forums for members looking for money – and cred with major criminal syndicates.

Russian hackers looking to earn a bit of extra cash after the holidays can turn to the cash prizes of a contest on the cybercriminal forum XSS. 

The competition, which has been around in some form since the mid-2000s, nowadays asks contestants to prove their expertise and write an article on a technical solution, according to a new report from Digital Shadows. In addition to a share of $15,000 in prize money, participating hackers have a chance to get noticed by major Russian cybercriminal organizations.

Topics for articles in the current XSS competition include searching for zero-day vulnerabilities and developing exploits, APT attacks, and tricks for new forensics. This year’s competition was sponsored and funded by the Sodinokibi (aka REvil) ransomware team.

XSS is not alone in running contests among its users. Russian forums including Verified, Korovka, and Omerta, among others, have sponsored competitions in the past.

For more, read here.

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “7 Steps to IoT Security in 2020.”

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/russian-cybercrime-forum-contests-bring-cash-visibility-to-winners/d/d-id/1336931?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 31/01/2020
  • adm

Android Malware for Mobile Ad Fraud Spiked Sharply in 2019

Some 93% of all mobile transactions across 20 countries were blocked as fraudulent, Upstream says.

Criminal groups are increasingly targeting users of Android mobile devices with malware for conducting ad fraud on a massive scale.

Mobile security vendor Upstream this week said that in 2019 it identified as many as 98,000 malicious Android apps and 43 million infected Android devices across the 20 countries where mobile operators currently use its technology. The numbers are up sharply from 2018 when Upstream recorded some 63,000 apps and 30 million infected devices.

A startling 32% of the top 100 most active malicious Android apps that Upstream blocked in 2019 were available for download on Google’s Google Play mobile app stores. Many of them still are, according to Upstream. Another 19% of the most worst-offending malicious Android apps were also on Google Play but have been removed, the vendor noted.

More than nine out of 10 — or 1.6 billion of the 1.71 billion mobile transactions that Upstream’s security platform processed last year — were blocked for being fraudulent. If those transactions had been allowed, the total cost to end users in fraudulent charges would have topped $2.1 billion, Upstream said in a report. In Egypt, 99% of the mobile transactions that Upstream’s platform handled were fraudulent.

Android is the most targeted mobile OS because of how widely it is used and also because the operating system is open and therefore more vulnerable, says Dimitris Maniatis, CEO at Upstream. 

Android is a favorite playground for bad actors, especially in the case of low-end devices, he says. “Users should have a heightened awareness of any preinstalled apps that come bundled with their device and pay attention to the mobile data usage by each,” Maniatis says. “Organizations should have measures in place to check the app’s reviews, developer details, and list of requested permissions, making sure that they all relate to the app’s stated purpose.”

Upstream’s analysis of 2019 data shows that the favorite apps for hiding ad-fraud malware are those that purport to improve productivity or improve device functionality. Some 23% of the malicious Android ads that Upstream encountered last year fell into this category. Other apps that attackers frequently used to hide malware included gaming apps, entertainment/lifestyle and shopping apps, communications and social apps, and music and audio and video players.

The top most downloaded malicious Android apps in 2019, according to Upstream, were Ai.type (an emoji keyboard), video downloader Snaptube, file-sharing app 4shared, video streaming and downloading app VidMate, and weather app Com.tct.weather. The top five apps alone have been downloaded some 700 million times. The top 100 malicious Android apps combined have been downloaded more than 8 billion times, Maniatis says.

In the US, the worst offenders, according to Upstream, were Free Messages, Video, Chat,Text for Messenger Plus; GPS Speedometer; QVideo, EasyScanner; and WhoUnfriendedMe.

A Stealthy Menace
In many cases, malicious apps do the function they are purportedly designed to do. For example, a weather app might forecast weather but in the background also carry out a variety of malicious activity without the user knowing a thing.

Malware for mobile ad fraud can visit websites and view and click on banner ads, make purchases, mimic a real user going through a subscription process, or deliver bogus ads to the device without the user being aware of the activity. The goal is to generate revenue for the malware author in different ways, including via payouts for fraudulent traffic and ad clicks.

Often such rogue apps can remain on a device for a long time because the malicious activity is only happening in the background. In some cases, the apps change their name after being downloaded or don’t have an icon to locate them easily.

“Losses from online, mobile, and in-app advertising reached $42 billion in 2019 and are expected to reach $100 billion by 2023, according to Juniper research published last May,” Maniatis says. “Considering that fraudsters operate at scale and can simultaneously target millions, tens of millions, or even hundreds of millions of devices in one hit, the means to stop them in their tracks need to likewise operate at scale.”

A vast majority of the victims are users of Android phones, especially in countries including Brazil, Egypt, Indonesia, South Africa, and Ethiopia.

While detecting malicious mobile apps can be difficult, there are often some indicators — like a constantly drained battery, an overheated device, or high data charges. User ratings and reviews are also sometimes a good indicator of an apps quality, though not always.

The most downloaded malicious Android apps, for instance, all had good reviews and high rating, but only because of a carpet bombing of fake reviews, says Maniatis. “The only way to get around this currently is to scroll enough and see genuine negative reviews from real users,” he says.

Related Content:

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “7 Steps to IoT Security in 2020.”

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/mobile/android-malware-for-mobile-ad-fraud-spiked-sharply-in-2019/d/d-id/1336930?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 31/01/2020
  • adm

Two Vulnerabilities Found in Microsoft Azure Infrastructure

Researchers detail the process of finding two flaws in the Azure Stack architecture and Azure App Service, both of which have been patched.

Check Point Research analysts who discovered two vulnerabilities in the Microsoft Azure cloud infrastructure have published the details of how these flaws were found and how attackers could potentially use them.

The research team began exploring Azure infrastructure in an effort “to disprove the assumption that cloud infrastructures are secure,” says security researcher Ronen Shustin in a blog post. Check Point informed Microsoft of the vulnerabilities as they were discovered throughout 2019; security patches were deployed for both flaws by the end of the year.

CVE-2019-1234 is a server-side request forgery bug in an on-prem Azure environment called Azure Stack, a hybrid cloud tool for enterprise use. A spoofing flaw exists when Azure Stack fails to validate certain requests. Attackers could exploit this by sending a crafted request to the Azure Stack portal; if successful, they could make requests to internal Azure Stack resources.

Researchers conducted this investigation by first installing the Azure Stack Development Kit (ASDK) on their own servers and mapping areas they thought they might find vulnerabilities. ASDK comes with a set of core components that can be extended via features like App Service and SQL Providers, among others. It has a limited number of features compared to the Azure cloud and usually runs software that’s a couple of versions behind, researchers explain. Azure Stack shares similar features with the Azure public cloud, so they focused on those vectors.

One Azure Stack service they investigated was called DataService, which didn’t require any authentication. This flaw could enable an attacker to obtain sensitive data belonging to any business with its machine running on Azure, whether it’s on a shared or isolated machine. They would first have to gain access to Azure Stack Portal and then send unauthenticated HTTP requests, which could provide screenshots and data about the tenants and infrastructure machines.

This vulnerability is only valid to the Azure Stack, which is also “a very valid attack vector,” said Yaniv Balmas, head of security research, in a meeting with reporters at last week’s CPX 360 event. “Practically, if someone has a big Azure Stack with a lot of tenants, I can take screenshots of other machines. It could be dangerous; it could not be. It depends.”

Remote code execution vulnerability CVE-2019-1372 is in Azure App Service, which lets users build and host Web apps, mobile backends, and restful APIs in a programming language they choose without managing infrastructure. The bug exists when Azure Stack fails to check the length of a buffer before copying memory to it. An attacker could let an unprivileged function, run by the user, execute code in the context of NT AUTHORITY/system and escape the sandbox.

Attackers could use this vulnerability to compromise tenant applications, data, and accounts by creating a free user in the Azure Cloud and running malicious Azure functions. Alternatively, they could send unauthenticated HTTP requests to the Azure Stack user portal. If successful, they could potentially take control over the entire Azure server and the business code it holds.

“[This] can give complete visibility into every workload running on the same server,” said Balmas. “[I] can modify them, I can delete them, I can do whatever I want.”

In its research, Check Point only used this vulnerability to demonstrate how it could be exploited to crash the Dynamic WAS Service (DWASSVC). However, it could also be used for privilege escalation, they explain in a blog post about CVE-2019-1372.

Related Content:

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “7 Steps to IoT Security in 2020.”

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/cloud/two-vulnerabilities-found-in-microsoft-azure-infrastructure/d/d-id/1336932?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

  • 31/01/2020
  • adm

Employers can’t force you to get microchipped, Indiana reps say

You’ve got two choices, employee: a) let us slide a syringe between your thumb and index finger so we can inject a rice-sized microchip into your hand that can be used as a swipe card to open doors, clock in, operate printers or buy junk out of the snack machine, or b) find another job.

An improbable scenario? Yes. It doesn’t happen – at least not if employees say no… For now. And the US state of Indiana wants to make sure it stays that way.

Last week, the state House of Representatives unanimously passed legislation – House Bill 1143 – stipulating that employers can’t force their employees to have an ID or tracking chip implanted in their bodies as a condition of employment. The bill passed the House 96-0 and is now heading to the Senate for consideration.

The bill’s sponsor, Rep. Alan Morrison, acknowledged that there aren’t any companies in Indiana – or anywhere, for that matter – currently forcing workers to be chipped if they want to keep their jobs, but there are businesses using the technology on a voluntary basis. As the Indiana Lawyer reports, Morrison said that he wants to be sure employers don’t “overstep their bounds” by imposing mandatory employee microchipping.

Privacy is an important thing. I don’t think there’s anything wrong with us being a little out in front of something.

Sure thing, said State Rep. Karlee Macer, who voted for the bill. On the other hand, we could spend our time legislating about issues that actually exist. NWI quoted her:

Think of the hundreds of bills that are sitting and waiting and never getting a hearing. There are a lot of important things we need to be doing in the state of Indiana.

But it’s so convenient!

There are at least two businesses that are using optional microchipping in their employees: Swedish startup hub Epicenter and Wisconsin-based Three Market Square.

At Epicenter, the injections have become so popular, they have parties for employees willing to undergo the procedure, as CNBC reported about three years ago (it’s been going on for years, in other words). It sounds kind of like a bris, except something gets added instead of snipped off.

CNBC quoted Patrick Mesterton, Epicenter’s co-founder and CEO, who said – while unlocking a nearby door by waving his hand at it – that it beats a bunch of pocket-stuffers:

The biggest benefit I think is convenience. It basically replaces a lot of things you have, other communication devices, whether it be credit cards or keys.

Mesterton said that even he had his doubts initially. The technology does raise security and privacy issues: the chips are safe biologically, but they generate data about how often employees come to work or what they buy. While you can stifle company swipe cards or mobile phones, it’s quite another prospect to rip a chip out of your flesh.

And as far as squeamishness goes, Mesterton compared the microchip to all the medical gadgets we’re putting in our bodies these days:

I mean, people have been implanting things into their body, like pacemakers and stuff to control your heart. That’s a way, way more serious thing than having a small chip that can actually communicate with devices.

For what it’s worth, Wisconsin-based Three Market Square also had a chipping party for willing employees back in August 2017. Their feedback: it was “just a little prick.”

According to the Chicago Tribune, officials said that the data in the microchip is encrypted and doesn’t use GPS, so it can’t be used to track employees or obtain their private information.

Hey, we’ve been microchipping our dogs and cats for years. What do you think, readers: ready to hold out your paws?

Latest Naked Security podcast

LISTEN NOW

Click-and-drag on the soundwaves below to skip to any point in the podcast.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/48XlhRwADKc/

  • 30/01/2020
  • adm

Facebook knows a lot about your online habits – here’s how to stop it

Facebook is rolling out a global tool to help you understand what other sites and apps tell it about your activities, to make it forget what they’ve shared in the past, and to control what they share in the future. It’s called Off-Facebook Activity, and it’s part of the company’s effort to appear more privacy-friendly to its users. This article looks at how to use it.

Facebook first launched its Off-Facebook Activity feature in August 2019, making it available in a few select markets at first. It shows you what third-party sites and apps share data with Facebook about your activities when you visit them. The social giant also launched a Clear History feature at the same time, which lets you disconnect that data from your account.

This week’s announcement sees the company rolling these tools out globally. So why do we need them, and how do they work?

Facebook doesn’t just log what you’re doing when you visit its site. It also interacts with many of the third-party sites and apps that you use. Those third parties send Facebook information about your activities including things like opening an app on your mobile, logging into it online using your Facebook ID, or even just visiting a site. Many sites also log your searches and purchases, or whether you added an item to a wishlist or cart.

They do this in three ways: the first uses Facebook’s Pixel. This piece of Facebook code is known more generically as a web bug, and it logs your activities on any site that embeds it, sending that information back to Facebook. The second is the Facebook SDK, which is a software toolkit that people can use to build similar capabilities into everything from mobile apps to PC games. There’s even a separate one for tvOS, the operating system inside Apple TV devices. Finally, they use your Facebook Login, which is the feature that lets you log into sites automatically when you’re already logged into Facebook.

Sites and apps send Facebook this information along with the unique identity of the device that you’re using, which they collect using a software tracker.

Facebook also knows what device you use, and it has your personal information too, so it can index your activity on all these sites against your real identity, not just a number. This is how the company builds incredibly detailed profiles of its users and what they do around the web. It doesn’t sell that information to third parties, but it does use it to help them target ads.

Users (and governments) have been increasingly concerned about this tracking activity, especially in the wake of the Cambridge Analytica scandal, and the Off-Facebook Activity function is Facebook’s response to that.

You’ll find the tool by clicking the down arrow at the top right of your screen, and then selecting Settings. From there, select Your Facebook Information in the left sidebar:

Then you’ll see the Off-Facebook Activity option halfway down.

Facebook shows you a list of the apps and sites that have shared information about your activities when you visited them.

Next to each item is a number indicating how many interactions of yours the app or site reported to Facebook. Clicking an item on the list reveals the Activity Details pane:

It doesn’t reveal exactly what those interactions were. Neither does it reveal very recent activity, which takes a few days to show up. There is a ‘Download activity details’ button which, when clicked, takes you to an existing Facebook feature that lets you download everything in a searchable file.

You can configure settings such as the period of time you want to download, and the file format. HTML is human-viewable while JSON is designed for programs to read. I suggest creating both. Facebook said it can take up to a few days to create a file, but it took just a few minutes to collate ten years of activity for my account.

Back at the Activity Details pane, there’s another option at the bottom: Turn off future activity. Clicking here pops up another pane like this:

Hit ‘Turn Off’, and within two days Facebook will stop connecting events from that third-party site or app with your account. It also means you won’t be able to use your Facebook ID to log into that site in the future, possibly forcing you to set up new credentials with third-party sites if that was your only login method.

Turning off future activity for an individual site doesn’t mean you’re done. For one thing, Facebook admits that this list isn’t comprehensive. It collects more details and activity that it doesn’t show “for technical and accuracy reasons”, including information that it gathers when you’re not logged into Facebook (see more information about shadow profiles). It also still has all the data that it’s already collected from these and other places. To disconnect that activity from your account, and to disconnect from all activity in the future even if it isn’t displayed on the Off-Facebook Activity screen, you need two other things: the clear history button and the Manage Future Activity link. Look for them on the top right of the Off-Facebook Activity screen:

When I selected Clear History, the pane showed me several third party sites and apps that were not listed in the main Off-Facebook Activity page.

Confirming that you want to clear your history prompts a banner from Facebook telling you that “your activity has been cleared.” Note that Facebook doesn’t actually delete that data. It told us:

If a person clears their history we disconnect the activity we’ve already received from their account. If they disconnect future activity, we won’t use their off-Facebook-activity to target ads to them and we won’t attribute any interests to them based on this data. It can take 48 hours to disconnect the information depending on how long it takes our system to process it.

We’ve created a new type of ID for people within our system called a “separable identifier. This means the information that identifies who they are can be separated from their off-Facebook-activity. When you clear your history, we complete the separation. For example, after someone clears their history we might know there was a visit to a shopping website, but we won’t know who went there.

If you want to turn off all activity, click on the Manage Future Activity link. This gives you two simple options: turn off your future Facebook activity using a slider, and then view the activity you’ve turned off.

Click the slider, and it’ll display a finger-wagging pane reminding you that you’ll still see ads, and they’ll still be personalised based on what you do on Facebook. It’ll sign you out of some apps and websites, and sites will still send Facebook data about what you do when you visit them. Facebook just won’t connect that data to your account.

If you click it and then select Manage Future Activity, Facebook will show a banner telling you that all future activity has been turned off.

This is a step in the right direction but it isn’t perfect. It would be nice if Facebook showed you all the activities recorded about you from all sites, upfront.

It would also be nice if it deleted your data when you cleared your history, and it would preferable if the company didn’t collect data that you generate when you visit other sites. It still will – it just won’t tie it to your account.

What can you do if you want to continue using the social network but its Off-Facebook Activity functionality isn’t enough for you? Firefox offers a Facebook Container that creates a boundary between Facebook sites and the rest of the web. EFF also offers its Privacy Badger extension to block third-party tracking based on site behavior, and there are several other signature-based blockers.

Latest Naked Security podcast

LISTEN NOW

Click-and-drag on the soundwaves below to skip to any point in the podcast.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/sYdMXSoeSaM/

  • 30/01/2020
  • adm