FFT news digest — 18 May 2018
FFT news digest — 18 May 2018
Email encryption
Researchers have demonstrated vulnerabilities in encrypted emails which could give an attacker access to the plaintext contents. Dubbed EFAIL, the method affects OpenPGP and S/MIME encryption technologies and only works if an attacker has already acquired the encrypted email. According to the researchers, “EFAIL abuses active content of HTML emails, for example externally loaded images or styles, to exfiltrate plaintext through requested URLs.” In practice, this involves taking an encrypted email, reformatting it and sending it back to the original sender or recipient. The email client decrypts it and, because of the way it handles HTML, sends the plaintext version back to the attacker. Email clients are being updated to address the vulnerabilities (the EFAIL site has details ), but this report highlights the fact that email was never designed to be secure and even adding encryption may not be foolproof. The other lesson is to make sure your email client doesn’t load remote or external content because this is a security risk, even if you don’t use encryption.
Secure messaging
Secure messaging
GDPR and consent
A week before the EU’s new data protection regulations become enforceable, the UK regulator has issued guidelines on consent. This is one of the most complex areas of the new rules and the timing reflects the fact that the EU only released its own guidance last month. As the UK Information Commissioner’s Office says , “the GDPR sets a high standard for consent. But you often won’t need consent. If consent is difficult, look for a different lawful basis.” The ICO’s advice is well worth reading because it provides a clear overview of the issues involved, and the need to ensure that consent is unambiguous and involves a clear, affirmative action. But you shouldn’t assume the GDPR requires everyone to renew their consent to receive a newsletter. And in the UK, it needs to be read in conjunction with the Privacy and Electronic Communications Regulations . The complexity of consent makes this an area in which legal advice is well advised.
Turkey/Pakistan
Researchers say opponents of the Pakistan and Turkish governments have been targeted with surveillance tools. Lookout Security said it had uncovered a phishing campaign run by the Pakistan military aimed primarily at officials in the Middle East. It said the attacks used Facebook Messenger to send malicious website addresses and therefore probably involved persuading targets to accept fake friend requests. Meanwhile, Access Now said the well-known FinFisher spyware had been used against critics of the Turkish government. This also used social media to drive traffic to a fake website which aimed to lure visitors into installing a malicious Android app. Both examples underline the importance of exercising caution with friend requests and with links sent over social media.
News tracking
A survey of news websites in seven European countries has revealed the extent of third-party content and tracking tools they use. The report from the Reuters Institute details the extent to which these sites “are deeply intertwined with a wider digital advertising and media ecosystem that involves data collection and sharing with numerous third-parties, sometimes without disclosing this to users.” According to the report, some of these practices are in potential conflict with the GDPR, and organisations will need to tackle issues of user consent to the collection, sharing and processing of personal information.
Browser risks
A flurry of reports demonstrate that web browsers remain a key threat for internet users. Proofpoint says malicious software dubbed ‘Vega Stealer’ seeks to steal credentials and credit card data which has been saved in Google Chrome and Firefox. The campaign involved phishing emails with an attachment containing macros that downloaded the software. Separately, a report from Radware details the risk of extensions for the Chrome browser, even when downloaded from the official Chrome web store. In this case, criminals subvert legitimate extensions as part of their campaign. Some extensions do add valuable functionality to web browsers but they are a favoured target for attackers and care should be taken before installing them.
In brief
Criminals continue to exploit the GDPR deadline to try to steal people’s credentials. As Trend Micro reports , among the latest examples is one pretending to be from Apple. Buzzfeed reports on why we should all be careful before accepting Facebook friend requests. It cost a reporter $13 to buy a highly credible fake profile with 921 friends. A teenager in California has been charged with hacking his school’s computers to raise his grades and lower those of people he didn’t like. The 16-year-old apologised and said he hoped to work in IT. More reasons to be cautious about voice-activated assistants. Researchers showed Amazon Alexa and Google Home could be tricked into opening malicious apps by using trigger words similar to those for authentic versions. Microsoft has halted deployment of its Windows 10 April 2018 Update for devices using some types of Intel and Toshiba solid state drives (SSDs). Details for Intel and Toshiba .
Updates
Adobe : updates for Acrobat, Reader, and Photoshop, many addressing critical vulnerabilities. Cisco : multiple updates include 3 for critical vulnerabilities in its Digital Network Architecture (DNA) Center appliance. SecureDrop : v 0.7.0 supports network administration and enables daily email notifications of new submissions. Privacy Badger : Electronic Frontier Foundation updates browser extension to provide enhanced blocking of trackers. VMWare : update fixes unauthenticated Command Injection vulnerability in VMware NSX SD-WAN by VeloCloud RedHat : update to address command injection vulnerability in DHCP client NetworkManager integration script.