security – Page 908 – STE WILLIAMS

Microsoft Remote Access Protocol Flaw Affects All Windows Machines

library
crime | hacking | security

Attackers can exploit newly discovered critical crypto bug in CredSSP via a man-in-the-middle attack and then move laterally within a victim network.

A serious vulnerability found in Microsoft’s Credential Security Support Provider protocol (CredSSP) could allow a hacker to gain control of a domain server and other systems in the network.

Researchers from Preempt unearthed the previously unknown remote code execution vulnerability, which affects all versions of Windows, and reported it to Microsoft in August of last year. Microsoft today issued a fix (CVE-2018-0886) for the protocol as part of its Patch Tuesday release.

The logical cryptographic vulnerability in CredSSP can be exploited via a man-in-the-middle attack when a client machine and server authenticate to one another over the Remote Desktop Protocol (RDP) and Windows Remote Management (WinRM) connection protocols. CredSSP forwards credentials, encrypted, from the Windows client to the server for authentication.

“We were able to find a classic mistake in the protocol and use that mistake to launch a man-in-the-middle attack,” says Yaron Zinar, lead security researcher for Preempt. Zinar and his team will demonstrate the attack next week in Singapore at Black Hat Asia, where they also will release an open source tool that exploits the vulnerability.

Zinar says with CredSSP, the server’s certificate doesn’t get validated by the client; it’s just signed and not hashed. “That allows us to create a malicious [and forged server] certificate that contains” a malicious executable, he says. The client then can be duped with a forged server cert.

Exploiting the flaw requires the attacker to wage a man-in-the-middle attack between the client and server in an RDP or WinRM session. He or she would need WiFi or physical access to the targeted network. A WiFi exploit could be set up using a key reinstallation attack such as KRACK, for example, according to the researchers. Other vectors are Address Resolution Protocol (ARP) poisoning and exploiting vulnerable network devices such as routers, to reach servers inside.

During the man-in-the-middle attack, the attacker basically awaits a CredSSP session to compromise the authentication between the client and server, and employ a remote procedure call attack on that server. “An attacker which have stolen a session from a user with sufficient privileges could run different commands with local admin privileges,” according to a blog post by Preempt on the attack. “This is especially critical in case of domain controllers, where most Remote Procedure Calls (DCE/RPC) are enabled by default.”

All the client machine user sees is a failed RDP message, so there’s little evidence that something went wrong with the remote session. An attacker then could end up with full control of the network if he or she then targets the victim’s domain controller.

“Exploiting the vulnerability was very difficult,” notes Zinar. “There were a lot of constraints about which packets we could use, and which certs we could use.”

Microsoft in its update today said the patch “addresses the vulnerability by correcting how CredSSP validates requests during the authentication process.” It recommends also using Group Policy settings or registry-based settings: “We recommend that administrators apply the policy and set it to ‘Force updated clients’ or ‘Mitigated’ on client and server computers as soon as possible. These changes will require a reboot of the affected systems,” Microsoft said in its update.

To defend against the CredSSP exploit, Preempt recommends patching workstations and servers, but warns that patching alone is not sufficient to stop this attack. Special configuration changes also need to be made, and blocking RDP and DCE/RPC can help. “If you don’t use RDP, turn it off on the machine. And if you are not using remote procedure calls, turn them off,” Zinar advises. “Also, decrease the use of privileged credentials. An admin should not use privileged credentials from WiFi, and sometimes not even from his personal workstation. From a dedicated workstation, maybe.

“And don’t use domain admins at all,” he adds.

Related Content:

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise … View Full Bio

Article source: https://www.darkreading.com/endpoint/microsoft-remote-access-protocol-flaw-affects-all-windows-machines/d/d-id/1331257?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Google ‘Distrust Dates’ Are Coming Fast

library
crime | hacking | security

All the tools are in place for the migration of SSL digital certificates on a scale that is unprecedented for the certificate authority industry. Are you ready?

The deadline is fast approaching for organizations to replace Symantec-issued SSL digital certificates, spurred by a Google decision last year to gradually deprecate all Symantec digital certificates because of failures on Symantec’s part to properly validate its SSL certificates before issuance.

Symantec, at the time, characterized Google’s claims as misleading and grossly exaggerated. The company claimed that only 127 certificates were identified as mis-issued and not 30,000. Symantec said that Google was singling it out for blame though the mis-issuance involved multiple certificate authorities (CAs).

Fast forward to today: Google has created a path for Symantec certificate holders to replace these certificates simply through DigiCert, in a fashion similar to a renewal process. The first of two dates related to this change will occur Thursday, March 15, and security teams need to be aware of how to deal with the process. But first, a bit of history and context.

When an SSL certificate is installed on a Web server, the connection between the server and browser is encrypted. Users know this security is in place because they see a padlock and the word “secure” at the start of the URL line as well as “https.” To enable this, businesses need to purchase and install a certificate from a valid CA. These certificates need to be renewed and reinstalled periodically — typically, every two to three years — to stay in compliance.

In early 2017, an issue was raised concerning a number of certificates issued by Symantec’s SSL business, which operated several CAs under Symantec ownership with the brand names of VeriSign, Equifax, GeoTrust, Thawte, and RapidSSL. For a number of reasons, these did not comply with industry requirements for browsers. There was an investigation, and it was deemed that Symantec had entrusted a number of organizations to issue certificates without the necessary oversight.

Google Steps In
The net result was that Google put a plan in place to distrust certificates issued by Symantec and all its subsidiaries over a period of time. At the time, Symantec was the largest CA and instead of making the necessary changes, it decided to sell the business to the second-largest CA, DigiCert, in November 2017, making DigiCert the overwhelming market share leader.

Google’s plans included three critical dates:

December 1, 2017: One month after the DigiCert/Symantec deal closed, validation and issuance of Symantec certificates were handled by DigiCert. No changes were required by the customers of either of the two companies.

March 15, 2018: Chrome 66 beta will distrust all Symantec certificates issued prior to June 1, 2016. Around April 15, 2018, the general, or stable, version of Chrome will feature untrusted warnings for these certificates.

September 13, 2018: Chrome 70 beta will distrust all certificates issued by Symantec. In October 2018, the general, or stable, version of Chrome will feature untrusted warnings for these certificates.

Companies that don’t comply with this will experience a situation in which users connecting to their site get directed to a page that warns them that the communication isn’t secure. That may or may not be a problem, depending on the site, but it’s often enough to scare people away and go click somewhere else, so keeping those certificates up to date is crucial.

A Headache for Big Business
Upgrading the certificates isn’t a big deal if you’re a small business with one or two Web servers. However, for large companies with thousands of servers, this can be a huge headache. Certificates are also now being deployed on Internet of Things devices, so if they aren’t upgraded, the communications won’t be encrypted or may stop transmitting information.

To help its customers make this shift, DigiCert has made available a website checker to see if companies needs to take action. For example, if “Symantec.com” is put into the URL line, the site issues a warning to replace the certificate before September 13, 2018. This simple tool lets customers quickly check which sites need upgrading and when.

DigiCert also has greatly simplified the process of procuring the certificates. What used to be a rather cumbersome set of tasks has been simplified to literally a couple of mouse clicks, and the certificate is renewed and upgraded. For companies investing in automation technologies, including the robust set of APIs that DigiCert offers, those few mouse clicks can be removed from the equation entirely.

In conversations with a number of customers, I’ve learned that these automation tools have been a huge time saver, with companies now able to upgrade all their servers in a fraction of the time it previously took. It’s important to note that SSL certificates are now being used on IoT devices as a way of encrypting the traffic to and from them, so many organizations should expect to see the number of certificates they need to manage grow exponentially.

One other important consideration: While most Web users won’t notice warnings until the April stable release of Chrome, I recommend that organizations upgrade their affected certificates now. Domains and organizations need to be validated before DigiCert can issue the certificate, and delays by customers can sometimes cost them a couple of days in getting their certificates. There’s actually no reason not to upgrade the ones affected by the September date either. Not getting it done in time will mean that when customers access the business website, they will be greeted with a Chrome security warning and that could drive them to a competitor.

In truth, a migration of this magnitude, which is unprecedented in the CA industry, could have been a disaster. Given that the acquisition of the Symantec CA business was only completed in November, DigiCert has done a remarkable job in consolidating the platforms and support organizations. All the tools are now there for customers to ensure that their Web servers won’t have a problem, so the ball is now in the court of security teams. The Google distrust dates are coming fast — are you ready?

Related Content:

Join Dark Reading LIVE for two cybersecurity summits at #Interop ITX. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop ITX 2018 agenda here. Save $200 off your conference pass with Promo Code 200MC.

Zeus Kerravala provides a mix of tactical advice and long term strategic advice to help his clients in the current business climate. Kerravala provides research and advice to the following constituents: end user IT and network managers, vendors of IT hardware, software and … View Full Bio

Article source: https://www.darkreading.com/endpoint/google-distrust-dates-are-coming-fast-/a/d-id/1331253?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

What CISOs Should Know About Quantum Computing

library
crime | hacking | security

As quantum computing approaches real-world viability, it also poses a huge threat to today’s encryption measures.

Image Source: Adobe Stock (zapp2photo)

Quantum computing is quickly moving from the theoretical world to reality. Last week Google researchers revealed a new quantum computing processor that the company says may beat the best benchmark in computing power set by today’s most advanced supercomputers.

That’s bad news for CISOs because most experts agree that once quantum computing advances far enough and spreads wide enough, today’s encryption measures are toast. General consensus is that within about a decade, quantum computers will be able to brute-force public key encryption as it is designed today.

Here are some key things to know and consider about this next generation of computing and its ultimate impact on security.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading. View Full Bio

Article source: https://www.darkreading.com/cloud/what-cisos-should-know-about-quantum-computing/d/d-id/1331239?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

AMD Investigating Report of Vulnerabilities in its Microprocessors

library
crime | hacking | security

Israel-based firm says it found critical bugs in AMD’s newest chip families.

AMD found itself in the bullseye this week as an Israel-based security firm today published a report of multiple critical vulnerabilities in the microprocessor vendor’s latest EPYC, Ryzen, Ryzen Pro, and Ryzen Mobile product families.

CTS Labs said it found exploitable manufacturer hardware-backdoors in the microprocessors that could allow an attacker to wrest away control of a victim’s machine. The vulns, which it dubbed Chimera, Ryszenfall, Fallout, and Masterkey, can bypass security protections, including Microsoft’s Windows 10 Virtualization Based-Security (VBS).

Details on how to exploit the flaws were redacted from the whitepaper, which CTS provided to AMD, some security firms, and US government regulators, CTS said. No other details were available as of this posting.

AMD apparently had little time to respond to the disclosure. “We have just received a report from a company called CTS Labs claiming there are potential security vulnerabilities related to certain of our processors. We are actively investigating and analyzing its findings. This company was previously unknown to AMD and we find it unusual for a security firm to publish its research to the press without providing a reasonable amount of time for the company to investigate and address its findings. At AMD, security is a top priority and we are continually working to ensure the safety of our users as potential new risks arise. We will update this blog as news develops,” the company wrote in an online post.

See the CTS report here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/endpoint/privacy/amd-investigating-report-of-vulnerabilities-in-its-microprocessors/d/d-id/1331267?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Microsoft Patch Tuesday: Prioritize Browser Updates

library
crime | hacking | security

All of the critical vulnerabilities Microsoft patched on March 13 were within, and related to, browsers.

Microsoft today addressed 75 unique vulnerabilities as part of its monthly Patch Tuesday update: of these, 14 flaws were categorized as critical and 61 as important. None were listed as under active attack.

Two of the flaws patched this month had been publicly disclosed. One of these was CVE-2018-0886, a CredSSP remote code execution bug that could enable an attacker to control a domain server and other systems throughout the network. Another is CVE-2018-0940, a privilege escalation vulnerability in Exchange Outlook Web Access (OWA) that would let an attacker replace a legitimate OWA interface with a fake login page.

Many key patches released for this month address flaws in the browser, points out Jimmy Graham, director of product management at Qualys. Microsoft issued 21 browser-related fixes, which included the 14 total bugs rated as Critical on Patch Tuesday.

“All of the critical vulnerabilities from Microsoft are in browsers and browser-related technologies,” he notes. “It is recommended that these be prioritized for workstation-type devices. Any system that accesses the Internet via a browser should be patched.”

Microsoft Report Details Different Forms of Cryptominers

library
crime | hacking | security

A new report explores different ways legitimate and malicious coin miners are appearing in the enterprise.

The future of digital currencies may be ambiguous, but their effect on cybercrime is crystal-clear. Cryptocurrencies have changed criminals’ motivation and the nature of cyberattacks.

As consumers explored the new frontier of digital wealth, so too have cybercriminals and malware developers. Both the anonymity and sharp value increase of cryptocurrency appeal to threat actors, who have most notably used Bitcoin to extort funds from ransomware victims.

Criminal activity related to cryptocurrency has driven a surge in different forms of cryptocurrency miners, otherwise known as cryptominers or coin miners. Microsoft’s Alden Pornasdoro, Michael Johnson, and Eric Avena, all with the Windows Defender Research team, have published a new report on the rise of various coin miners and their enterprise presence.

“Mining is the process of running complex mathematical calculations necessary to maintain the blockchain ledger,” the researchers explain. It’s not malicious, but it does require hefty computing resources to generate coins. Many people and businesses invest in the equipment to legitimately do it. Some people don’t want to make this infrastructure investment, and instead explore ways to use coin mining code to tap into the computing resources of somebody else’s devices.

For cybercriminals, this is a chance to build coin miners and use them nefariously. The researchers’ report digs into the details of coin mining malware, web-based mining scripts, and legitimate but unauthorized cryptomining applications, and how they are deployed and used.

Trojanized coin miners

Oftentimes, cybercriminals change existing cryptominers and drop them on target computers using malware, social engineering, and exploits. Between Sept. 2017 and Jan. 2018, an average of 644,000 machines encountered coin mining malware each month, Microsoft states. Some are more sophisticated than others, using exploits or self-distributing malware to spread.

“The vast majority of attacks are financially motivated and based on the return-on-investment for attackers,” says Kevin Epstein, vice president of Threat Operations at Proofpoint. As ransomware campaigns have proven less lucrative amid growing consumer awareness, many criminals are turning to cryptominers and integrating coin mining into Trojans to make money.

Exploit kits, once used to mainly deploy banking Trojans and, most recently, ransomware, are now used to spread coin miners. Researchers point to the example of DDE exploits: One sample of the malware is delivered as a malicious Word document that launches a PowerShell script and downloads a Trojanized version of Monero cryptominer XMRig. Some criminals use social engineering: one malicious file called “flashupdate,” disguised as Flash Player, also uses an altered version of XMRig.

Once a coin miner makes its way onto a target machine, it aims to stay there.

“For cryptocurrency miners, persistence is a key element,” Microsoft researchers explain. “The longer they stay memory-resident and undetected, the longer they can mine using stolen computer resources.” Criminals use scheduled tasks, autostart registry entries, code injection, and other fileless techniques to maintain their presence by evading detection.

Browser-based miners

Some coin-mining scripts are hosted on websites, a trend also known as “cryptojacking” that has increased amid the interest in cryptocurrency. These websites mine coins using the computing power of people who visit. Some sites prompt visitors to run the script; others do not.

To keep people from leaving, some of these malicious sites host video streams. Researchers have also found tech support scam sites that double as coin miners. Visitors are distracted with pop-ups and stay on the site as criminals mine coins in the background.

Legitimate miners, illegitimate use

A growing enterprise problem is the presence of legitimate but unauthorized coin miners that people use in business environments because they don’t want to use their resources at home. These drive energy consumption and costs, and are tougher for security teams to detect because they don’t arrive through traditional infection vectors.

Microsoft reports in 2018, Windows enterprise users running potentially unwanted application (PUA) protection saw coin miners on more than 1,800 enterprise machines. The number is expected to increase as organizations keep a closer eye out for these programs.

PUAs are different from Trojanized miners, which are considered malware, and “unwanted software,” which are considered harmful because they change Windows without users’ control. PUA protection, enabled by default in the System Center Configuration Manager, can be configured by security admins with PowerShell cmdlets or Microsoft Intune.

Windows Defender antivirus blocks PUAs when users attempt to install programs meeting certain conditions, researchers explain. These mostly include software bundling programs, browser modifiers, and programs with poor reputations. They increasingly include coin miners, which made up 2% of PUAs in Sept. 2017 and 6% of PUAs in Jan. 2018.

Related Content:

Join Dark Reading LIVE for two cybersecurity summits at Interop ITX. Learn from the industry’s most knowledgeable IT security experts. Check out the security track here. #InteropITX 2018 Early Bird Rates Expire March 16. Use Promo Code 200KS to Save an Extra $200.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/endpoint/microsoft-report-details-different-forms-of-cryptominers/d/d-id/1331266?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Cryptomining isn’t going to make you rich

library
crime | hacking | security

Is cryptomining-with-consent the simple alternative to web advertising that some publishers think it is?

For sure, it’s not universally popular, as news site Salon discovered a month ago when it started offering visitors the choice of either turning off their adblocker or allowing the site to run what was identified in pop-ups as Coinhive’s AuthedMine Monero (XMR) miner.

The main reason for the negativity isn’t hard to pin down: to have any chance of being viable on the average PC, Monero cryptomining must grab CPU cycles, which can mean imposing anything from a 25% performance overhead and up.

Most users will notice this and want to turn it off. But even if they don’t, there is the ethical issue of whether the users who consented understood the implications of handing a chunk of their PC performance to a website to use for its own purposes.

Now a new calculation based on a real-world case study has suggested a more surprising problem – cryptomining might not be profitable enough in the first place.

According to data seen by a group of researchers, a company that embedded Coinhive on 11,000 ‘parked’ domains (i.e. lacking content), for three months generated 0.02417 XMR with a value of $7.69 (£5.50).

Although the average visit time was only 24 seconds, and the number of sessions a modest 105,000, the sum appears a lot less optimistic than Coinhive’s own estimate of 0.3XMR (currently $78) with “10-20 active miners.”

What counts is how this compares with serving the same pages through a conventional advertising model. This is a matter of conjecture, but the authors reckon:

Freely available web calculator tools suggest we might expect an order or two of magnitude greater for comparable traffic.

Another way to measure the viability of cryptomining is to ask whether it has any chance of covering publishing costs.

The editor of Virus Bulletin, Martijn Grooten, who backed the study’s calculation, tweeted:

So on that on-browser cryptocurrency mining as an alternative to ads, I don’t think you have to calculate hash rates to see that it doesn’t make the site anywhere near enough money.

I think we forget how expensive the average article is and thus how much money has to be (and often is) generated through ads….

Or perhaps – and we’re speculating here – Salon’s decision to give cryptomining a go is simply part of a clever strategy designed to make readers view turning adblockers off in a more positive light.

Some people think it would be better if readers just paid to read articles, for example through schemes such as Google’s Contributor which allows micro-payments. Launched last June, take-up for this so far has been modest, which in turn puts people off because they can’t use their credit on enough sites.

The small paradox of all this is that while publishers struggle, cryptomining in the form of non-consenting cryptojacking continues to be an issue. Surely someone, somewhere is making money out of Monero.

Follow @JohnEDunn
Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/Fi3UemrBS00/

Tweet thieves suspended by Twitter

library
crime | hacking | security

As BuzzFeed News so nicely put it, the Tweetdeckoning has come.

On Friday, the platform cleared house of a particular kind of leach, suspending several popular accounts known for ripping off other people’s tweets or jokes without crediting the original creator and for making money by retweeting the plagiarized content.

BuzzFeed reported in January that the so-called “tweetdeckers” are youngsters – typically in their teens and 20s – who have huge followings and who are making thousands every month by selling the retweets.

The practice, which is against Twitter’s policy against spam, gets its name from groups called “decks.” To score an invitation to join a deck, accounts usually need a follower count in the tens of thousands.

From Twitter’s spam policy, which defines spam to be, among other things…

…duplicative or substantially similar content, replies, or mentions over multiple accounts or multiple duplicate updates on one account.

Customers – both individuals and brands – pay tweetdeckers for a specified number of retweets to go out across deck member accounts with the aim of ‘going viral’. A single retweet fetches payment in the range of $5-$10. Subscriptions that last a week or month can cost several hundreds of dollars, depending on a given deck’s popularity. Some decks even hand over temporary access to the whole deck, BuzzFeed reports, something like a subscription to unlimited deck retweets.

Back in January, BuzzFeed quoted one tweetdecker who it identified as an 18-year-old from Chicago named Kendrick, or @Simpmild. He said he was making between $3,000 and $5,000 a month, and he pays members of his decks “based on who has the most page activity for the month”.

It’s the simplest thing ever, all you do is have your friends join and you have fun and tweet and make money. It’s the easiest thing ever. No hard work at all.

Kendrick had been running two of his own decks. Following Twitter’s purge, his account was suspended.

Also suspended were popular accounts including @Dory, @GirlPosts, @SoDamnTrue, Girl Code/@reiatabie, Common White Girl/@commonwhitegiri, @teenagernotes, @finah, and @memeprovider. Some had hundreds of thousands or even millions of followers.

After BuzzFeed first reported on tweetdecking in January, Twitter announced new spam-fighting changes to Tweetdeck, including removing the ability to select multiple accounts to automatically tweet, retweet, like or follow.

That’s it, game’s over, a 23-year-old tweetdecker told BuzzFeed when the changes were announced in February:

Tweetdecking is over. Our follower gains are gonna diminish.

And this is an example of how happy many Twitter users were at the idea, as choruses of “Let’s get this #TweetDeckIsOverParty started” sounded throughout the land:

“Continuing its battle against the “tweetdeckers,” Twitter suspended on Friday several popular accounts known for s… twitter.com/i/web/status/9…

—
Rosemary (@RMAjayi) March 12, 2018

Follow @LisaVaas
Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/7QtYwt_BAWw/

‘Hacked’ Facebook taunt leads to 1-star restaurant reviews

library
crime | hacking | security

Here’s what typically happens after a particularly heated football match: fist-pumping, “Ya-ya, in yr FACE messages” posted on social media.

But in a classic social media way, the raspberry-blowing got a lot nastier following Sunday’s game between Celtic and Rangers: bitter rivals, both based in Glasgow, UK.

Namely, a post appeared on the Facebook page of a local restaurant owner, making fun of Rangers for losing. Somebody working the Facebook account of Shindy Singh, the boss at the Indian Sizzler, called Rangers “zombie scum” and told the players to “get back into ur graves”, inserting a handful of “laughing until I weep” emojis:

…a post that was picked up by a number of Rangers fan groups, including Rangers on Tour. Fast flew the angry and offensive comments, along with threats to leave bad reviews and to book tables and takeaway in an effort to put some financial hurt on the restaurant.

They weren’t joking. The furious football fans carried through on the threats, leaving a stream of 1-star reviews on the Indian Sizzler’s Google review page. Of course, we can’t tell what’s a valid review, from somebody who actually ate there and wound up with gastroenteritis, vs. the “how DARE you call us zombies” fans, but an awful lot of 1-star reviews sprang up following the game, along with an awful lot of people praising the food in spite of football fury.

Singh posted that he wasn’t responsible for the “zombies” taunt; rather, he was hacked, he said on social media, and he’s alerted police:

This isn’t the first time that people have chosen to punish a business by writing bad reviews of places they’ve never stepped foot in. It happened to a New York restaurant called Feast in 2014. After management had the audacity to ask patrons to take off their Google Glass headwrap while they were dining, a tsunami of bad reviews came in that had nothing to do with food or service but instead focused on the fact that the restaurant was run by “luddites.”

Just as happened to Feast, so too have incensed reviewers reacted to the presumably vengeful 1-star reviews by upvoting the Indian Sizzler. It was up to 4.7 stars as of Tuesday morning.

Both these two and plenty other tit-for-tat review wars get into issues about ethics, morals, legality, common sense, and privacy. Those are good conversations to have, but at the end of the day, business owners suffer when fan boys and girls use social media as cudgels.

Your team can’t un-lose a football game with all the 1-star reviews in the world. People who can’t take a bit of post-game jeering – be it from Facebook hackers or business owners who just don’t want to see their business tank – should revisit the notion of sportsmanship.

Follow @LisaVaas
Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/nIvBog17hAA/

Firefox turns out the lights on two privacy-sucking features

library
crime | hacking | security

Did you know that the websites you browse can ask your phone how far away your face is from the screen, and that they can determine the ambient light levels of the room you’re in?

No, me neither, and I do this stuff for a living.

The fact it is that the web browser you’re using now is stuffed full of exotic, esoteric, somebody-somewhere-will-use-them features of questionable utility.

These features, often APIs (Application Programming Interfaces) that allow websites to act more like native apps, give sites access to some of your device’s most sophisticated capabilities, exposing everything from your GPS, gyroscopes and accelerometers, to proximity and ambient light sensors.

Until recently that list also included access to your battery charge level. It doesn’t now, on Firefox at least, thanks to the work of Lukasz Olejnik and the boldness of the Firefox development team.

The Battery Status API was killed off in late 2016 because, while it had almost no legitimate uptake at all, it became quite popular as a browser fingerprinting technique for cookie-less tracking.

Mozilla’s decision to flense the Battery Status API from Firefox, a move described by Olejnik as “unprecedented”, was a welcome check on the trend to fold ever more complexity (and attack surface) into web browsers.

And now that trend is about to hit another bump.

We’ll soon be losing proximity and ambient data from the list too, on Firefox at least, thanks to… the work of Lukasz Olejnik and the boldness of the Firefox development team!

From Firefox 62 onwards, the legacy APIs for proximity and ambient light, exposed via the devicelight, deviceproximity and userproximity events, will be disabled by default. Websites won’t be able to access them unless you turn them on, and if you want to do that you’ll have to dig them out of Firefox’s UX-challenged configuration graveyard, the about:config screen.

So what’s wrong with these features?

The proximity API, which tells websites how far away the thing nearest a device’s proximity sensor is (typically a hand or face), is being switched off because it could be abused as an identifier for fingerprinting, used to discriminate between users or even used in behavioural profiling.

The ambient light sensor gets the chop because of some eye-catching work by Olejnik demonstrating how it can be abused by a malicious websites to leak your browsing history, or to copy images from other sites you’re looking at (a violation of the same-origin policy).

Like many browser history attacks, the ambient light sensor leak leverages the fact that the colour of visited and unvisited links can be controlled.

By displaying visited links as white on black and unvisited links as black on white, a malicious website could cycle through a series of likely URLs, displaying each one in turn and using the changes in ambient light to determine the colour of the screen.

To their credit, developers at Mozilla seem keen to get ahead of these potential privacy issues and have nipped these leaky sensor APIs in the bud, before they’ve become widely used or abused.

The march of progress is relentless though, and both proximity and ambient light data could soon be accessible again via a new Generic Sensor API. The new API is currently being put through its paces and it remains to be seen if Firefox’s latest prohibition will extend to the ambient light and proximity parts of that API, or indeed if it will need to.

No doubt Olejnik will be there to tell us if it should.

Follow @NakedSecurity
Follow @MarkStockley

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/sTMqpXYNmOQ/