FFT news digest — 20 July 2018
FFT news digest — 20 July 2018
Cyberwar laid bare
Cyberwar laid bare
Legal sector under attack
Legal sector under attack
Privacy International
The world’s most powerful governments have been accused of entrenching authoritarianism by exporting their surveillance capabilities without regard to the destination. Privacy International said the US, UK, China, France and Germany were among those “transferring their electronic surveillance capabilities, practices, and legislation around the world.” Rather than increasing security, Privacy International says state ‘security assistance’ programmes are facilitating human rights abuses, and diverting resources from long-term development programmes. Meanwhile, Human Rights Watch has called on the US Justice Department to disclose its policies on the use of compromised smartphones to monitor suspects. The method involves infecting devices which are then sold to the suspected criminals. It underlines the importance of taking extreme care when buying phones, even if they come in a shrink-wrapped box.
Do as we say…
Like everyone else in cybersecurity, we’re guilty of bombarding people with advice not to reuse passwords. Hopefully, we’re unlike nearly half of our peers who fail to follow their own advice. Security company, Lastline, surveyed 306 people at this year’s Infosecurity Europe conference in London. It found that 45% admitted reusing passwords across different accounts, and 20% said they had used unprotected public Wi-Fi hotspots. Lastline doesn’t provide details of the people it surveyed and many people at the conference are not technologists, but you would expect attendees to have a better than average understanding of cybersecurity risks. We’re the first to accept that passwords are broken, but there are solutions. We have more detailed thoughts on the subject here , and the NCSC has guidance on its website. Good password hygiene and two factor authentication can improve your security radically; it’s time professionals put their preaching into practice.
State of cybercrime
Malwarebytes says it has seen a fall in the volume of malicious software detected by its products, and criminals are increasingly targeting personal data. Cybercrime Tactics and Techniques pulls together data from the company’s business and consumer products which are installed on millions of machines. It found widespread use of Twitter as part of technical support scams in which attackers pose as a helpdesk to try to secure access to a victim’s device. In one case, a computer was compromised and criminals were able to monitor the victim’s emails. This meant that when the victim contacted Malwarebytes, the criminals replied with an email saying there wasn’t a problem. Among other threats, one of the most common is Adware which includes aggressive advertising and unwanted software. Ad blockers like uBlock Origin are an excellent defence against this sort of threat.
Security challenged
There’s been an extraordinary rise in Business Email Compromise, with reported losses more than doubling over the past two years. The FBI’s Internet Crime Complaint Center (IC3) says the technique now constitutes a worldwide industry worth $12.5 billion; between 2013 and 2016, the figure was around $5 billion. The technique (also known as ‘whaling’) targets high-value individuals and transactions. The FBI says there’s an increasing focus on the real estate sector, and on personal data which can be used for identity and tax fraud. There are multiple variants, but the most common approach is to send a spoofed email which seeks to persuade the recipient to transfer money to a fraudulent account. The FBI recommends making use of multiple forms of communication to verify transactions. Senior managers should also avoid posting details of their movements on social media because this is used to identify when and how to target an organisation.
In brief
The UK Inquiry into Child Sexual Abuse has been fined £200,000 for failing to use the Bcc field in a mass email. The mistake meant recipients saw each other’s email addresses, identifying them as possible victims of child sexual abuse. More than 26,000 devices were lost on London’s transport network in the year to last April. last year. The figures were obtained by think tank, Parliament Street. They underline why Mobile Device Management is essential. Two US Senators have called for an inquiry into smart TVs and their ability to track what users are watching. More generally, internet-connected TVs are often horribly insecure and there is little consumers can do to make them safer. In the most serious such breach yet seen in Spain, Telefonica revealed personal details of its Movistar customers. The issue was caused by a basic error in the design of its website which meant changing the address revealed information about another user. Security company, Coronet, has produced a list of the US airports where it’s most risky to connect to WiFi, with San Diego at the top. The report (registration required) highlights the importance of taking precautions when travelling Devious researchers have come up with a way to trick GPS receivers into giving false directions. It works by spoofing the packets of data sent by satellites to smartphones and vehicle navigation systems. The cost of the equipment they used; $223.
Updates
Cisco : Multiple updates addressing critical vulnerabilities in Policy Suite as well as issues in Webex and SD-Wan Solution. Oracle : Massive dump of patches for no fewer than 334 vulnerabilities. Skype : Microsoft goes further down the road of enraging many Skype desktop users by announcing decision to force upgrade to version 8.0. Zimbra : Releases Zimbra 8.8.9 “Curie” Patch 1, Zimbra 8.8.8 “Turing” Patch 7 and Zimbra Collaboration 8.7.11 Patch 5.