FFT news digest — 18 January 2019
FFT news digest — 18 January 2019
Stolen credentials
The discovery of a vast collection of credentials on the MEGA cloud service underlines the importance of making sure you don’t reuse passwords. Security researcher, Troy Hunt, said the database contained nearly 773 million unique email addresses and 22 million unique passwords. Security journalist, Brian Krebs, spoke to the seller of the collection who appears to have several similar databases on offer, some of them even bigger. The credentials appear to come from several different sources and in some cases it’s the first time they have been seen in a data breach. You can use Troy Hunt’s Have I Been Pwned? site to check whether you’re affected. Databases like this one are used in “credential stuffing” attacks where emails and passwords are tested against online services until a working combination is found. The popularity of such attacks makes it essential to use a password manager to remove the temptation to take the risky route of using the same password for different services. We have more information here .
Misunderstanding Facebook
Three quarters of Facebook users don’t understand that the company creates profiles of their online activities and interests, according to the Pew Research Center. Pew surveyed 963 US adults and found 51% of them were uncomfortable with what Facebook does. You can check what Fecebook thinks your interests are by opening its ad preferences page. This allows you to remove interests, manage advertisers and select what ads are shown to you. Meanwhile, Facebook has revealed that Russian disinformation campaigns continue to try to exploit it. In a blog post, it said it had removed 471 Facebook pages and accounts which had engaged in “coordinated inauthentic behavior on Facebook and Instagram.” It added that the operations originated in Russia, with one active in a variety of countries and the other specific to Ukraine.
Lessons from Singapore
The importance of getting the basics right has been demonstrated yet again by a report into a cyber attack that led to the theft of health records belonging to about a quarter of Singapore’s population, including the Prime Minister. Singapore’s Data Protection Commission found a healthcare agency and an IT provider had failed to “make reasonable security arrangements.” It listed basic precautions that had been ignored and said staff lacked the “awareness, training and resources” to respond to the attack. As with so many incidents, it appears to have begun with a phishing email that gave the attackers access to critical systems. Among the report’s recommendations are improved security testing, tighter controls on administrative accounts and better staff awareness.
Airline tickets
A reminder to take care of flight reservation details, courtesy of a researcher in Israel. He noticed that a link sent to customers after they booked a flight could be used to access details of other people’s flights. The issue was with an El Al flight but it turned out to affect the Amadeus reservation system used by more than 200 airlines, including American Airlines, British Airways and Qantas. The cause of the vulnerability is the Passenger Name Record (PNR) which stores a range of information including names and passport details. This has long been a security concern because PNRs can often be found in photographs of boarding passes on social media sites. With only the PNR and passenger surname, it’s possible to access the reservation, view details and makes changes. Attempts by Amadeus to fix the latest vulnerability are reported to be incomplete, but the wider issue is that PNRs make it too easy to access sensitive information and the airline industry has yet to find a solution to that problem.
2FA under attack
We predicted that 2 Factor Authentication (2FA) would be a growing target for attackers in 2019, and it’s taken less than three weeks to be proved correct. After releasing a tool designed to bypass 2FA, its author asked whether the approach was broken. We don’t think so and a poll carried out by Threatpost agrees . It found that, even though there are ways to defeat 2FA, it is still an essential element in improving security. It did recommend hardware tokens as the most secure solution (Google announced last year that since it started using them, not a single employee had been successfully phished). But most respondents felt that even authentication codes sent as SMS messages were better than nothing. 2FA is one of the simplest ways to enhance security. It’s worth visiting twofactorauth.org to check whether the services you use support it.
Free VPN warning
Free VPN warning
In brief
We like the Android operating system but it’s an inescapable fact that it’s riskier than Apple’s. A study by Nokia found Android devices are nearly 50 times more likely to be infected by malware than those from Apple. That means The UK’s National Cyber Security Centre has reminded anyone with Windows 7 devices that by this time next year they will no longer be supported. As the NCSC observes, it’s crucial to move away from unsupported platforms as quickly as possible. The World Economic Forum has warned about the vulnerability of networked societies, saying “the blind spot risk that needs more attention is technology.” Its latest Global Risk Report puts cyber attacks and data breaches in the top 5 global risks in terms of likelihood. An executive from TV manufacturer, Vizio, has told The Verge that the company would have to charge more for devices that didn’t enable it to collect data about its users. In a move away from its roots, YouTube has told users to avoid “harmful and dangerous content”. The updated policy follows an upsurge in videos showing people trying to copy scenes from the film ‘Bird Box’ and navigate the world while blindfolded. Apple says it replaced 11 million iPhone batteries in 2018, at least 5 times more than usual. The rise was driven by a cut price offer which is also believed to have reduced take-up of new models.
Updates
Microsoft : Updates for Windows 10 to address issues with third-party applications having difficulty authenticating hotspots. Also fix for Skype for Business Server. Microsoft : Updates to address problems connecting to network shares on Windows 7 and Windows Server 2008. Oracle : January update includes total of 284 new security fixes across the company’s products. 33 of the fixes address vulnerabilities rated Critical. Many products are affected by multiple vulnerabilities. Drupal : Updates for Drupal 7, 8.5 and 8.6 address two potentially serious vulnerabilities that can be exploited for arbitrary code execution.