FFT news digest — 22 June 2018
FFT news digest — 22 June 2018
Learning lessons
Learning lessons
Dangers at work
Dangers at work
Bad ads
Newly-discovered malicious software illustrates why it’s essential to be cautious about clicking on advertisements, especially those offering free services. The program was discovered by Bitdefender which named it Zacinlo. It appears to have been in operation since 2012 but became particularly active last year when it was bundled with what seemed to be a free VPN solution. Once downloaded, it would pretend to perform as a VPN but in fact would only act as a delivery mechanism for the malicious software. Its main aim is to generate advertising revenue by creating fraudulent clicks but it’s also capable of taking screenshots which could allow it to steal usernames and passwords. Most victims are in the US, with 90% of them running Windows 10.
Unseen
A venerable tool in the criminal’s portfolio is making a comeback, this time to combat Microsoft’s natural language processing. The ingenious approach involves using a zero size font to hide words so that they are invisible to the reader but also to language analysers. These work by scanning the content of emails for signs of impersonation or fraud. Researchers from Avanan found examples of malicious emails which would look normal to a human but appear to be random, unthreatening text to a natural language processor. The result is a way to circumvent Microsoft controls and display a malicious link to the user. The answer is to remember the basics and never click on a link to manage an online account. If you’re concerned, go direct to the settings by typing in the address in a new browser window.
Password spraying
Microsoft has released a preview of a new tool designed to help eliminate bad passwords. Azure AD Password protection will protect Azure AD and Windows Server Active Directory accounts. It will work by blocking the most commonly-used passwords, as well as variants of them. This matters because of an increasingly popular way of trying to take advantage of our tendency to use poor passwords. ‘Password Spraying’ involves testing a common password like P@55word123 against every user in an organisation. To succeed, they only need one person to be using it. The other failures don’t ring any alarm bells because they look like an isolated, failed login. By preventing bad passwords being used in the first place, the password spray is guaranteed to fail.
HTTPinSecure
There’s been an upsurge in the use of websites with valid security certificates to attack users, particularly Netflix subscribers. This underlines the importance of not assuming that a web address beginning HTTPS is safe. The Internet Storm Centre says the attack involves taking over a poorly-secured website and using it to create a site that could be mistaken for a genuine Netflix one. Criminals then apply for a certificate for the Netflix-related name which makes users more likely to think it’s genuine. In general, Netflix is hugely popular among scammers so caution is advised with any emails which appear to come from it. A highly-effective tool is available to help combat certificate fraudsters. Called Certificate Transparency, it monitors certificates as they’re issued so website owners can see if someone is impersonating them. Researcher, Scott Helme, has an excellent guide .
In brief
Multi-factor authentication is one of the most effective ways of increasing security but many people don’t use it . New guidance from the UK’s National Cyber Security Centre sets out how to implement it. Cambridge Analytica may have collapsed amid scandal and recriminations but the AP reports that at least 4 of its senior officials have set up a new company which is working on President Trump’s 2020 campaign. Is your home a Fortnite home? If so, be aware that the Android version of the hugely popular game is not yet available. Scammers are taking advantage of this to try to persuade users to download a malicious app that could compromise the device. The Federal Court of Australia has ordered Apple to pay around US$6.6 million in penalties for misleading customers over their rights. Apple had disabled iPhones and iPads which had been repaired by third parties. Rubbish photo on Facebook? No worries. Using Artificial Intelligence, researchers have come up with a way to insert eyes if you’re snapped mid-blink. They’ve called it ’ eye-in painting .’ Many of us may have been frustrated when the website name we want isn’t available. Few of us would react by trying to steal it at gunpoint. Sherman Hopkins Jr did. It didn’t go well. He’s been sentenced to 20 years in a US federal prison.
Updates
Cisco : 34 updates, including 24 for Firepower firewalls and Nexus switches. 5 are rated ‘critical’. Axis : new firmware addresses seven security issues across nearly 400 cameras (many used for security surveillance). G-Suite : Google releases update to give administrators more visibility about devices which are accessing corporate data. SecureDrop : announces next version 0.8.0 due to be released on June 26.