FFT news digest — 7 September 2018
FFT news digest — 7 September 2018
BA data breach
British Airways faces difficult questions after announcing a data breach which resulted in the loss of personal and financial details. Some 380,000 transactions made between August 21 and September 5 are affected. BA’s CEO, Alex Cruz told the BBC that the stolen information includes, “name, address, email address, credit card number, expiration date and three letter code [i.e. CVV code]”. Mr Cruz declined to give any details about how its website and mobile app servers were compromised, but BA will need to explain how the attackers were able to obtain credit card information which should have been encrypted. On a practical level, the incident illustrates why it’s a bad idea to allow websites to store financial information (even if they say they do it securely). BA customers should also change their password and make sure the old one is not used for any other account. Anyone affected by the breach should also contact their card provider.
Encryption threat
The Five Eyes intelligence alliance has stepped up pressure to secure access to encrypted communications. Following a meeting in Australia, the US, UK, Canada, Australia and New Zealand released a statement arguing for targeted access on the grounds that “privacy is not absolute”. While emphasising that the intention is not to weaken encryption, the alliance told technology companies to co-operate and warned that if they refused, legislation would be considered. Law enforcement agencies have been increasingly frustrated by their inability to view the contents of end-to-end encrypted communications. But, despite the thinly-veiled threats, their statement doesn’t address the fundamental challenge of how to break encryption without breaking encryption.
Chinese phishing
Non-news of the week; China is using LinkedIn to target and recruit sources in the US. The head of the U.S. National Counterintelligence and Security Center (NCSC) told Reuters that China’s “super-aggressive” approach has been raised with Microsoft (which owns LinkedIn). This isn’t news because LinkedIn is a go to resource for anyone seeking information about an individual…or an organisation. (Not for nothing is it known as the “phisherman’s friend”.) We mention this because there is a remarkable degree of over-sharing on LinkedIn. It may be an excellent shop window, but it’s worth checking how much of your private information is on public display. See how your profile looks to a stranger. Review your privacy settings, only accept connection requests from people you’ve met, and be wary of links and documents in LinkedIn messages. This is not to diminish LinkedIn’s value, only to reflect the importance of the data it holds.
Bossing fraud
Nearly half a million UK businesses are estimated to have been hit by impersonation fraud, with small and medium firms suffering an average loss of £27,000. The figures are based on data from Lloyds Bank which has joined with Get Safe Online to produce a video showing how the scams work. The research found that over half of those surveyed said they had experienced someone posing as their boss or as a supplier. And 5% of victims were so ashamed that they tried to hide their mistake, potentially making the situation even worse. There’s no reason for embarrassment because many of these attacks are sophisticated and extremely credible. Does your organisation encourage the reporting of honest mistakes? Does it even reward them? Cyber resilience is better than an aspiration to a perfect cyber defence. Humans will be, well, human. Ensure your organisation can respond to a cyber attack and learn from it.
Human error
We’re fiercely opposed to blaming and shaming individual users when things go wrong, even if it’s an unavoidable fact that most data security incidents are caused by human error. Security company, Kroll, analysed 2 years worth of incidents reported to the UK Information Commissioner’s Office. Of almost 2,500 reports, only 292 were the result of a malicious attack. All the rest were mundane mistakes, including emailing confidential data to the wrong recipient, losing data, or leaving it in an insecure location. As Kroll points out, most of the incidents happened before the enforcement of new EU data protection rules so the figures provide an incomplete picture. What they do illustrate is the need to help people avoid making simple mistakes, rather than blaming them when they happen.
Strongest link
Twin lawsuits are shining light on the twilight world of surveillance technology. The New York Times reports that the lawsuits include recordings of phone calls made by the editor of a London-based Arab newspaper who had no idea he was under surveillance. According to the lawsuit, the recordings were apparently part of an effort to persuade the United Arab Emirates government that it was worth paying to upgrade spyware they were already using. The lawsuits are being brought against the NSO Group, a US-owned company based in Israel which is one of the best known spyware manufacturers. Their Pegasus tool can infect a smartphone if the user clicks on the link in an SMS or social media message. Research has shown just how powerful it is and why links, especially unsolicited ones, should be treated with extreme prejudice.
In brief
“Secure” storage service, MEGA, says its Chrome browser extension was hijacked. The malicious version aimed to steal credentials for sites including Amazon and Google. An alleged blackmailer used Facebook messages to find out answers to password reset questions. He then accessed his victims’ accounts and stole explicit pictures which he used to blackmail them. Memorable questions are a lousy security measure and should be banned. Set up 2 factor authentication wherever possible. Tech support scams have become so commonplace that Google has been forced to launch a program to weed out the malicious ones. Unsolicited calls offering to fix a computer problem are almost certainly a scam. Just hang up. 44% of US Facebook users aged 18-27 have deleted the app from their phone, according to a survey by the Pew Research Center. The findings come from polling conducted at the beginning of June. Apple’s Airdrop feature can be invaluable but needs handling with care, as passengers on a Hawaiian Airlines flight discovered. Buzzfeed reports the flight was grounded after a number of passengers received a photo appearing to show a crime scene and a dead child. It turned out a high school student was trying to share a biology class photo with her mother. Gnashing of teeth at the UK’s TV Licensing agency which was forced to take down its website because users were being asked to provide sensitive data over unencrypted connections.
Updates
Chrome : Major update for Google’s browser includes improved password manager features. We continue to advise using a separate solution to store and manage passwords. Cisco : Multiple updates for a range of products to address multiple vulnerabilities including 18 rates critical or high severity. Skype : Latest version includes call recording. Firefox : Update addresses multiple vulnerabilities which could be exploited to take control of an affected system. Tor : new version implements latest Firefox codebase and most of its features. Also simplifies set-up process and anti-censorship features. Tails : Version 3.9 enhances support for additional software installation, and integrates Veracrypt data encryption. SecureDrop : Version 0.9.0 includes new feature to enable journalists to download replies to sources, an API for the Journalist Interface, and upgraded version of Tor. Apple : announces Logic Board Replacement Program for the iPhone 8. It says “a very small percentage” of phones sold between September 2017 and March 2018 have a manufacturing defect that can lead to restarts, freezes or a failure to start.