FFT news digest — 6 April 2018
FFT news digest — 6 April 2018
Stable doors
Amid the flurry of stories surrounding Facebook, it would be easy to miss its admission that a combination of lax policies and ‘malicious actors’ means data will have been collected on most of its users. In a Q&A with the media, Mark Zuckerberg said a “huge mistake” had been made in not taking a broad enough view of the company’s responsibility. Until recently, Facebook allowed searches by email address or phone number. This type of information is readily available and so criminals are believed to have used Facebook to harvest additional information on people they wished to target. This process (which is not unique to Facebook) has been common knowledge for years and yet Facebook has only now blocked this type of search. Zuckerberg is due to testify before the US Congress on April 11. His admitted failure to discharge his responsibilities is likely to loom large in the questioning.
Protecting data
Facebook has denied reports that it won’t implement measures to comply with new European Union privacy rules outside Europe. Mark Zuckerberg said the company would “make all controls and settings the same everywhere, not just in Europe.” The new General Data Protection Regulation applies to the personal data of anyone resident in the EU. Picking and choosing where to apply the rules would create a minefield for a company like Facebook so worldwide compliance is the only logical course of action. The new rules do give individuals a greater degree of control over their personal data and represent a turning point in the relationship between Facebook and its users. Since they cover data already collected, what went on in the Wild West days of the web may come back to haunt…
Scanning content
Both Facebook and Microsoft have made clear the extent to which they access content transported over their platforms. Facebook told Bloomberg it analysed Messenger conversations and images to ensure they comply with company rules. And Microsoft has updated its terms of service to include a code of conduct which, if broken, could lead to an account being closed. Among the behaviour forbidden on Microsoft services, including Skype and Office 365, is the sharing of inappropriate content, including “nudity, bestiality, pornography, offensive language, graphic violence, or criminal activity”. While the aim of the changes may be to crack down on abuse, they’re also a salutary reminder of the reality of access to private content.
Russian mobiles
Russian mobile phone operators have begun auditing their customers to identify anyone using unverified accounts. Several leading operators told RBC magazine (Russian) that they were taking the action to comply with new rules coming into force from the beginning of June. A new law passed last year requires companies to cancel services for anyone who hasn’t verified their identity. This tightens a widely-ignored law that did little to crack down on the sale of “grey” SIM cards. The Russian authorities have taken a series of measures to impose stricter controls on communications, including restrictions on tools used for anonymous web browsing.
Once a target
Like burglars, once they’ve attacked a target successfully, hackers tend to come back for a second bite. FireEye’s annual report says the number of organisations attacked twice has almost doubled since 2013. In other findings, the report says lack of multi-factor authentication (or poor implementations of it) is a key risk for organisations. The report also covers the duration of attacks, with breaches in Europe, the Middle East and Africa taking almost six months to be detected. And FireEye highlights what it calls a “significant increase in the number of cyber-attacks originating from Iran-sponsored threat actors.” Where once Iran’s activities were mainly a “nuisance”, FireEye says it “is now operating at a pace and scale consistent with other nation state-sponsored groups.”
Strongest link
Let’s face it, cybersecurity isn’t necessarily the first topic of conversation when people get to work in the morning. But making it part of everyday conversation is the best way to improve security inside an organisation. A new survey by Tech Pro Research (subscription required) found the biggest challenge to implementing strategies was to get employees to comply with them. We sympathise but we also think cybersecurity is a subject too often kept in a box and let out only when something goes wrong or when a compliance requirement needs to be met. As the furore around Facebook demonstrates, there are always stories that bring information security and data protection to life. Bringing them into daily conversation is a big step towards improving security and making strategies real.
In brief
Tor is ending support for Tor Messenger because of limited resources. The chat program aimed to provide a cross-platform solution for secure messaging. The US Department of Homeland Security says it has identified devices in Washington DC which it believes are being used to track and monitor cellphones. The ‘Stingrays’ work by pretending to be a normal cellphone tower. Fake messages offering free Virgin Atlantic tickets are doing the rounds on WhatsApp and Facebook. Sophos reports that they make use of an r with a dot underneath it to try to fool users into clicking on what looks like a link to the Virgin Atlantic website. Apple’s latest update for macOS is reported to have caused problems with external displays. Among those affected are DisplayLink, Duet Display, and Air Display. All advise users not to update to High Sierra 10.13.4. Intel has advised users to uninstall its Remote Keyboard application after serious vulnerabilities were found in it. The Android and iOS apps provide wireless control of Intel NUC and Compute Stick devices.
Updates
Tails : 3.6.2 provides updates to Tor Browser, Thunderbird, Linux, and includes mitigation for Spectre variant 2 vulnerability. Zimbra : 8.8.8 includes messaging platform with support for videoconferencing and group messaging. Android : April Security Bulletin includes nine vulnerabilities rated critical. Microsoft : emergency update for Malware Protection Engine.