Facebook privacy – the 20,000 who just logged out (and why) | foodonia

“I have had emails from all around the world – and they are all positive,” says Dutch Merijn Straathof, head of a project encouraging people to leave Facebook, in the wake of the recent privacy uproar over the site’s psychological experiment on its users.

The 99 Days project aims to work out a more profound question: does the site make us happy? Users are encouraged to change their profile to a countdown and not log in at all for the duration.

Every month, scientists from Cornell and Leiden universities will ask questions to assess their happiness, psychological state and relationship to the site. A We Live Security guide may help concerned site users control Facebook privacy and data use by the site – which, as Staarthof found out, is something users find hard to contemplate life without.

Facebook privacy: What happens when you leave

“People couldn’t imagine this world we live in now, where we look at this site all day,” says Straathof. “The step of leaving it forever is too big for people. That’s why we came up with 99 days.”

The 99 Days project was started by an advertising agency, and Straathof says that the relentless happiness of the site is one of the things he hopes to throw light on. You cannot “dislike” a post. People do not confess to being unhappy. People compete for attention – and scammers prey on this. This is a mode, Straathof says, that has fallen out of favor among advertisers – as too unsubtle.

“Most of the people who contacted me said they spend too much time on Facebook,” he says. “An hour a day. Two hours. Add that over a month, and it’s a small holiday – in this digital reality. People are thinking, ‘I don’t have the time to do this’.”

What has surprised Straathof is that Facebook ‘quitters’ are not worried about Facebook privacy as much as some perhaps expected.

“People don’t think about it – what the meaning of privacy is, or why we should cherish it,” says Straathof. “People say that they have nothing to hide. But if everything is digitized, it will still be there for decades. If it’s publicly archived, future governments will have all this data. Our current privacy discussion is not big enough to change things.”

People’s concerns with the site are simpler than worries over Facebook privacy – “They are not sure if they get happier. In America, families use it to stay in touch with people far away. In Holland, family tend to be near. This digital reality can cause negative feelings.”

The University of Michigan researchers behind a previous Facebook study used “experience-sampling” – questionnaires about well-being at random times five times a day – which is considered among the most reliable methods of judging how people feel, think and behave.

“This result goes to the very heart of the influence that social networks may have on people’s lives,” said Michigan cognitive neuroscientist John Jonides.

They found that the more participants used Facebook over the two-week study period, the more their life satisfaction levels declined over time – whereas interacting in the “real world” had the opposite effect.

Facebook privacy – ‘Alone together’

Previous books such as MIT Professor Sherry Turkle’s Alone Together interviewed users who felt they were creating a “false identity” on the site.

“I work in advertising,” says Staarthof. “This is staged happiness. Users are creating this persona, and they realize that other people are doing it. It’s not 100% reality. All those amazing things in your friends’ feeds – it’s narcissistic. People are just trying to be popular. No one ever posts, ‘I’m feeling sad.’ The only possible response is positive – sharing positive things.”

What is less clear is whether the “happiness” of Facebook is in any way real – or if the site can be altered to make its users happier.

“Is it a recipe to create happiness online?” asks Staarthof. “No. It’s staged happiness. I work in advertising – and it feels like adverts from years ago. Coca Cola is a brand that’s about happiness – and years ago, those adverts were people smiling, enjoying Coca Cola. Now it has to be more sophisticated – send a Coke to Africa, interact with the real world.”

“Can Facebook be altered to make people happier?” asks Staarthof. The first questionnaire will go out to participants in 19 days, with questions assessing the wellbeing and psychological effects.

“Facebook is a very attractive medium for advertisers,” says Staarthof. “But creating this presence, on your phone in a digital world – is it better to put the phone down and do something authentic?”

For a shorter term solution – try WLS’s video guide to how to get rid of ANY embarrassing post on the site.

The post Facebook privacy – the 20,000 who just logged out (and why) appeared first on We Live Security.

Brought by: http://foodonia.com

Internet of things – tests show almost all devices “riddled” with flaws | foodonia

Isolated flaws in “connected” devices such as Wi-Fi lighting systems make headlines – but the problem is far deeper than thought, with 70% of the most popular such gadgets having serious security flaws according to a report by HP.

Devices under test included televisions, home thermostats and door locking systems – and on average, each had 25 serious flaws, some of which could hand private information to attackers, according to Phys.org..

The researchers did not name the products, saying their goal was not to “name and shame”.

Devices collected and stored private data such as names, email addresses and credit card details, and also failed to encrypt such data. Others allowed users to set weak passwords – with several devices allowing passwords such as “1234”. Half of the devices under test did not encrypt communications to the cloud, network or internet.

Internet of things – network of flaws

The study, described by EWeek as unique, focused not just on the devices themselves, but on the networks they interacted with.

A typical “connected device” will connect to a network, to a mobile device, and to a cloud service. Each of these connections poses risks. As yet, this troubling aspect of IoT devices has not been studied intensively.

Daniel Miessler, practice principal at HP, said: “The current state of Internet of Things security seems to take all the vulnerabilities from existing spaces – network security, application security, mobile security and Internet-connected devices – and combine them into a new, even more insecure space, which is troubling.”

CBR said that the findings raised questions over the security of industrial control systems, which also integrate with other networks, and which may not have examined in such detail.

Internet of Things: A solution?

HP called for vendors to address security issues with their devices – and also suggested more radical solutions.

“You can put the IoT devices on another separate network,” Miessler said.”You should separate networks so that any IoT devices can’t interact with other things on the protected network.”

Recently, a vulnerability in LiFX, a well-known Kickstarter-funded lighting system where a network of bulbs can be controlled via smartphone app was described by Electronics Weekly as a “warning for all Internet of Things companies”.

Speaking toElectronics Weekly, Context’s Michael Jordon said, ““It is clear that in the dash to get onto the IoT bandwagon, security is not being prioritised as highly as it should be in many connected devices We have also found vulnerabilities in other internet connected devices from home storage systems and printers to baby monitors and children’s toys.”

The post Internet of things – tests show almost all devices “riddled” with flaws appeared first on We Live Security.

Brought by: http://foodonia.com

Microsoft denies it has ever been asked to plant a snooping backdoor into its products | foodonia

Whether you like it or not, the authorities would like to see what people are saying to each other online.

It is, of course, a controversial issue with strongly held opinions on both sides.

Law enforcement and intelligence agencies argue that having insight into private conversations on social media sites like Facebook, via email and instant messaging chats, could help them gather information about organised criminal gangs and perhaps prevent a terror attack.

Many others, especially in the wake of Edward Snowden’s revelations in the last 12 months, believe that the authorities have overstepped the bounds of their authority by secretly monitoring conversations, hacking into innocent companies, weakening encryption standards, and even planting malware on IT hardware as was shipped to customers from manufacturers.

Aside from issues of the individual’s right for privacy and the need for transparency as to how our governments are choosing to treat the citizens who voted them into power, concerns have been expressed that big software companies might have worked in cahoots with the likes of the U.S. National Security Agency.

After all, wouldn’t it be much easier for the NSA to spy on communications sent via the internet if the very companies who created the software that facilitated, say, instant messaging or video chats, had built in a secret backdoor?

Unfortunately, any method to waltz past security (whether it be by exploiting a known weakness in a encryption standard or some secret method that grants a third-party access) could potentially be exploited by far more than just the law enforcement authorities.

In short, building a way to wiretap internet communications can lead to less secure systems for all of us.

So, I was pleased to see Scott Charney, Corporate Vice President for Microsoft’s Trustworthy Computing Group, confirm in a panel appropriately entitled “Striking the Right Balance between Security and Liberty” that his company has never been asked by the US government to backdoor its products, and if they ever were they would fight it “tooth and nail”:

Greg Miller, National Security Correspondent, The Washington Post posed the question:

Greg Miller: Can you tell us whether, in addition to the government being able to compel a company like yours to turn over data that is transiting through your networks, can it also compel you to change your code? Can it compel you to change your products to enable it to get access to products like Skype?

Scott Charney: So, one, they have never done that, and two, we would fight it tooth and nail in the courts. So, under the wiretapping statute in FISA you can be compelled to provide technical assistance. But if they said, for example, put in a backdoor or something like that, we would fight it all the way to the Supreme Court.

Look, if the government did that – and I really don’t think they would – it would be at the complete expense of American competitiveness. If we put in a backdoor for the US government we couldn’t sell anywhere in the world – not even in America.

It’s clear that Microsoft has been rattled by newspaper stories revealing the scale of its information sharing with the NSA, and is keen to differentiate between court-ordered requests from agencies that follow legal processes and software backdoors.

Last month, on the anniversary of Edward Snowden’s first revelations about NSA snooping, Microsoft called for the US government to reform the NSA by ending the bulk collection of telephone record data, committing not to hack data centers and to increase transparency.

Whether Microsoft is doing this because it genuinely believes this is the right thing to do, or because it realises it faces huge commercial hurdles if it is perceived to be in the pocket of the NSA, doesn’t really matter. I suspect it’s a bit of both.

I’m just pleased that they seem to be sticking up for us.

If intelligence and law enforcement agencies have a genuine need to spy upon some communications then it should not be via a backdoor that could put millions of innocent, law-abiding users at risk.

The post Microsoft denies it has ever been asked to plant a snooping backdoor into its products appeared first on We Live Security.

Brought by: http://foodonia.com

Accounts hacked: Stubhub $1m cyber fraud ticket scam busted | foodonia

Ebay’s online ticket resale service Stubhub fell victim to a cyber-scam where a “global gang” used 1,600 hacked accounts on the service and bought and resold tickets, laundering the profits through European banks – earning a total of $1m.

Three criminals behind the spate of Stubhub accounts hacked were arrested in New York, and a further three in London, according to the BBC’s report.

The scams were complex, involving data from other corporate breaches (such as email addresses and passwords) which were then used to breach legitimate Stubhub accounts – eBay emphasised that its servers had not been accessed, after a high-profile attack earlier this year reportedly exposed customer data.

Accounts hacked – ‘no data breach’

The criminals – described by New York County’s district attorney as a “global cybercrime ring” also used malware to obtain Stubhub logins.

Stubhub’s global head of communications, Glenn Lehrman, said in an interview with Reuters that victims have been reimbursed, and that the firm has been working with law enforcement around the world for more than a year.

Lehrman said, via Sky News’ report, “We did not have anyone who hacked into our system” and described a “pretty intense network of cyber fraudsters working in concert with one another.”

“The arrests today relate to fraudulent transactions that were detected on existing Stubhub customer accounts in 2013,” said spokesman Glenn Lehrman.

Passwords from previous data breaches

“These legitimate customer accounts were accessed by cybercriminals who had obtained the customers’ login and password either through data breaches of other websites and retailers, or through the use of key-loggers and/or other malware on the customer’s own PC.

“Once fraudulent transactions were detected on a given account, customers were immediately contacted by Stubhub’s trust and safety team, who refunded any unauthorised transactions.”

Money was laundered through UK bank accounts from the hacked Stubhub accounts, Lehrman said, according to SC Magazine’s report.

The use of credentials stolen in data breaches highlights the importance of changing details if you suspect your password and username may have leaked in such an attack. AN ESET guide to what to do in this event can be found here.

The post Accounts hacked: Stubhub $1m cyber fraud ticket scam busted appeared first on We Live Security.

Brought by: http://foodonia.com

Online privacy fears as Tor rushes to fix “uncloaking” bug | foodonia

The developers of the Tor online privacy service are fixing a weakness which could have exposed the identities of hundreds of thousands of users of sites around the world – potentially putting lives at risk, as political activists in oppressive regime rely on the online privacy service to make communications hard to trace.

The hack was due to be exposed at the Black Hat security conference in Las Vegas – but the talk was abruptly cancelled due to legal concerns.

The talk, entitled “You Don’t Have to be the NSA to Break Tor” aimed to showcase a technique which could “uncloak” users of the anonymizing web service for less than $3,000 .

The details of the method have not been disclosed, and the Tor Project has moved rapidly to fix the bug.

Online privacy – Tor users fear ‘uncloaking’

Black Hat said via a post on its official website, “One of our selected talks, ‘You Don’t Have to be the NSA to Break Tor: Deanonymizing Users on a Budget’ by CERT/Carnegie Mellon researcher Alexander Volynkin was scheduled for a Briefing at Black Hat USA this August in Las Vegas.”

“Late last week, we were informed by the legal counsel for the Software Engineering Institute (SEI) and Carnegie Mellon University that: “Unfortunately, Mr. Volynkin will not be able to speak at the conference since the materials that he would be speaking about have not yet approved by CMU/SEI for public release.” As a result, we have removed the Briefing from our schedule.”

‘Questions’ for researchers behind hack

The Tor Project said that it had not forced the cancellation of the talk – but that it had “some questions” for the researchers.

Roger Dingledine said via a post on the Tor forums that, “I think I have a handle on what they did,” reassuring users that a fix for the bug was imminent.

Using the free Tor browser, you can access special .onion sites – only accessible using the browser – which are used by political activists worldwide to post information untraceably.

Other Tor sites openly host highly illegal content including pirated IP, drug markets, child pornography and sites where credit card details are bought and sold.

Tor Project leader Roger Dingledine said, “Based on our current plans, we’ll be putting out a fix that relays can apply that should close the particular bug they found. The bug is a nicebug, but it isn’t the end of the world. And of course these things arenever as simple as “close that one bug and you’re 100% safe”.

The post Online privacy fears as Tor rushes to fix “uncloaking” bug appeared first on We Live Security.

Brought by: http://foodonia.com

World of Warcraft account hacked – should thieves face jail? | foodonia

Account hackers and thieves who loot magic weapons, armor and hard-won game currency from players in massively multiplayer titles such as World of Warcraft should face the same sentences as real-world thieves, a politician has suggested.

The British Member of Parliament Mike Weatherley, chief advisor to Prime Minister David Cameron on intellectual property, suggests that crimes involving virtual items with real-world monetary value should be treated in the same way as offline thefts, according to a report in The Independent.

Gamers who steal virtual items in online games such as cases where a World of Warcraft account hacked should receive the same sentences as ‘real-life’ thieves, the MP suggested, according to an interview with radio station NewsTalk.

World of Warcraft account hacked?

Weatherley is a player of the popular fantasy game – which is a constant target for cyber criminals due to its large player base and the correspondingly high value of in-game items. Situations where gamers find their World of Warcraft hacked are common, and cyberciminals even launder money via in-game auctions.

Speaking to Buzzfeed, the MP said that authorities should not waste time over small-scale thefts.

“It’s a scale thing as well,” he said. “If you’re a genuine hacker, so to speak, and you’ve stolen the money out of thousands of accounts, then I think that’s a general theft problem that needs to be addressed very seriously.”

Such items are commonly stolen by hackers targeting player accounts – either with malware or phishing attacks. Once an account is compromised, criminals sell items for game currency, which can be exchanged for real money on various specialist sites.

A We Live Security guide to common scams which can lead to account theft in online games outlines some of the risks online gamers face.

Most online games include mechanisms to prevent direct theft – but crimes perpetrated via malware or phishing are often punished by game companies, rather than law enforcement, via penalties such as bans, account suspenson or the deletion of large amounts of game currency.

“If you’ve spent £500 on building up your armed forces and someone takes them away online, I guess you can feel hard done-by and you want your £500 back,” Weatherley said. “People shouldn’t be doing it.”

“The perception from some people is if you steal online it’s less of a crime than if you steal physically. If it genuinely is someone who’s paid in the game and they’ve had that stolen, that’s probably no different to something in the physical world.”

Mike Penning, the Minister of State for Justice responded that sentencing in such cases was “a matter for the courts.”

The post World of Warcraft account hacked – should thieves face jail? appeared first on We Live Security.

Brought by: http://foodonia.com

Smart Phone, Safe Car? | foodonia

The post Smart Phone, Safe Car? appeared first on We Live Security.

Brought by: http://foodonia.com

Tesla Model S hacked to open doors while in motion | foodonia

Tesla’s Model S has been hacked to make the doors and sun roof open while the car is in motion - and the researchers behind the attack were able to control the systems remotely.

The post Tesla Model S hacked to open doors while in motion appeared first on We Live Security.

Brought by: http://foodonia.com

Shaggy Dogma: Passwords and Social Over-Engineering | foodonia

Given the 'nightmare' that is password management, is Microsoft right to say that it's sometimes OK to re-use the same memorable password on several sites?

The post Shaggy Dogma: Passwords and Social Over-Engineering appeared first on We Live Security.

Brought by: http://foodonia.com

Is your Point of Sale machine protected against attacks? | foodonia

Criminals are very interested in retailers’ Point of Sale (PoS) machines. Recently, a new type of malware has been found that specifically tries to break into PoS machines, called Win32/BrutPOS.A.

The post Is your Point of Sale machine protected against attacks? appeared first on We Live Security.

Brought by: http://foodonia.com

Wi-Fi security – the new ‘bulletproof’ router (and how to toughen yours) | foodonia

A new project aims to protect homes and small businesses from the security failings of Wi-Fi routers, a problem which has repeatedly hit the headlines over the past year.

The post Wi-Fi security – the new ‘bulletproof’ router (and how to toughen yours) appeared first on We Live Security.

Brought by: http://foodonia.com

Android/Simplocker using FBI child-abuse warnings to scare victims into paying $300 | foodonia

Last time we wrote about Android/Simplocker – the first ransomware for Android that actually encrypts user files – we discussed different variants of the malware and various distribution vectors that we’ve observed. Android/Simplocker has proven to be an actual threat in-the-wild in spite of its weaknesses…

The post Android/Simplocker using FBI child-abuse warnings to scare victims into paying $300 appeared first on We Live Security.

Brought by: http://foodonia.com

Comic-Con 2014: Eight super-powered digital safety tips | foodonia

Over the past few years, Comic-Con has had over 130,000 attendees, and those attendees tend to be very digitally literate - so that means we will probably see double that number of connected devices - laptops, tablets, smartphones and perhaps even tricorders.

The post Comic-Con 2014: Eight super-powered digital safety tips appeared first on We Live Security.

Brought by: http://foodonia.com

‘Sextortion’ blackmail attacks on the rise, Police warn | foodonia

‘Sextortion’ attacks where cybercriminals blackmail victims with the threat of exposing explicit photographs or messages are increasingly common, according to a report by Bloomberg News.

The post ‘Sextortion’ blackmail attacks on the rise, Police warn appeared first on We Live Security.

Brought by: http://foodonia.com

Insider threat – should you worry about the ‘enemy within’? | foodonia

Disgruntled employees and other malicious insiders could be one of the most serious security threats companies face - but the importance of the threat from the ‘enemy within’ varies according to who you ask.

The post Insider threat – should you worry about the ‘enemy within’? appeared first on We Live Security.

Brought by: http://foodonia.com

Facebook scams target grieving families of Flight MH17 | foodonia

Callous cybercriminals have used the Malaysia Airlines Flight MH17 tragedy as a lure for Facebook scams - creating fake profiles for victims of the crash.

The post Facebook scams target grieving families of Flight MH17 appeared first on We Live Security.

Brought by: http://foodonia.com

Wi-Fi security alert on Chromecast as ‘Rickmote’ hijacks nearby boxes | foodonia

A security researcher has built a remote control which hijacks any nearby Chromecast highlighting a Wi-Fi security issue, which allows an attacker to play a 'surprise' video on nearby gadgets.

The post Wi-Fi security alert on Chromecast as ‘Rickmote’ hijacks nearby boxes appeared first on We Live Security.

Brought by: http://foodonia.com

Privacy concerns over Police ‘instant ID’ camera trial | foodonia

New facial recognition technology which can instantly identify people from any digital image in seconds is being trialled in the UK for the first time.

The post Privacy concerns over Police ‘instant ID’ camera trial appeared first on We Live Security.

Brought by: http://foodonia.com

Artist mails NSA ‘uncrackable’ mixtape | foodonia

An artist has created what he claims to be an ‘uncrackable’ mixtape, using freely available encryption tools and housed on a home-made device, and posted it to America’s National Security Agency (NSA).

Neowin reports that the move is an attempt to voice disquiet over the NSA’s surveillance of electronic communication – and to highlight the importance of encryption tools.

Artist David Huerta describes how the mixtape is secured using freely available encryption tools via a post on Medium – and explains that the tracklisting has only ever been shared on paper, rather than digitally.

The ‘tape’ – actually a bespoke device created using an Arduino microcontroller board – is purposely recorded at low quality to mimic what Huerta imagines to be the low-quality of intercepted phone calls.

Encryption tools create ‘blind spot’

Vice reports that the device is meant to highlight the fact that while government organizations can compromise computer systems and devices, “the actual cryptography connecting those systems was still something it fundamentally can’t break.”

ESET Senior Security Researcher Stephen Cobb says in a blog post explaining the importance of encryption to business, “Encryption of files, whether stored on a drive or emailed via Outlook, not only gets you Safe Harbor when something does go astray, it also buys you considerable peace of mind.”

“The device contains a soundtrack for the modern surveillance state. It’s designed to be enjoyed only by people I have consented it to be listened to,” Huerta says.

Private key

Huerta kept one copy of the ‘tape’ and mailed the other to the NSA’s Maryland headquarters - minus the public key required to decrypt it. Huerta wants his tape to be “a reminder” of the power of encryption.

“Encryption is the blind spot to the NSA’s all-seeing eye. Math doesn’t need an information dominance center to enforce its rules. Math is the legal framework which the universe can only obey and will trump and outlast the rules of any human state,” he writes.

“For the common person to have access to encryption was the result of several Promethean acts of defiance against the military powers that wanted to make cryptography only available to themselves to weaponize.”

The post Artist mails NSA ‘uncrackable’ mixtape appeared first on We Live Security.

Brought by: http://foodonia.com

Hacked Japanese porn sites spread banking malware attack | foodonia

هذا الملخّص غير متوفِّر. يُرجى النقر هنا لعرض المشاركة.

Data breaches in New York have tripled | foodonia

Data breaches have hit a record high in the state of New York, with 900 breaches affecting 7.3 million people in 2013, according to records released by the state attorney general.

The New York Times notes that the rise in serious data breaches was driven by criminal attacks, with computer hackers “by far” the leading cause of data breaches, responsible for 40% of unauthorized data access in 2013.

Bloomberg’s Businessweek calculates that data breaches have tripled in the period 2006-2014, with “mega breaches” such as the Target data breach partially responsible.

Since 2005, New York law has required companies to notify the attorney general whenever a data breach has exposed private data such as social security numbers, driver’s license details, names and account numbers, according to the Westfield Republican.

Data breaches – hacking now biggest threat

“What’s truly shocking about this report, beyond the fact that hacking is now the greatest threat to our personal information and costs us billions of dollars, is that many of these breaches could have been prevented,” New York’’s attorney general, Eric T Schneiderman said in a statement.

Bloomberg News said that since 2006, New Yorkers had experienced 5,000 data breaches, exposing the records of 22.8 milllion New Yorkers in total.

‘Collaborative approach’ to data breaches

Apart from criminal attacks, the remainder of breaches suffered by New Yorkers were caused by loss or sale of equipment, employee errors, and insider attacks, according to Associated Press.

Schneiderman said, “Our expansive look at data breaches found that millions of New Yorkers have been exposed without their knowledge or consent.”

The attorney general said that his office would take a “collaborative approach to address the complex problems surrounding data security.” Bloomberg reports that Schneiderman said that “engaging industry stakeholders and security experts, as well as lawmakers” could offer new tools for protecting New Yorkers’ private information from data breaches.

The post Data breaches in New York have tripled appeared first on We Live Security.

Brought by: http://foodonia.com

“I’ve been hacked, and now I’m pregnant!” | foodonia

We put trust in technology every day.

We drive a car to work, and trust that its brakes won’t fail too badly, and that its engine won’t explode in a massive fireball on the dual carriageway.

We tap words into a computer, and trust that someone didn’t goof up the wiring and that we’re not going to get an electric shock.

We drink water, and trust that the computers at the water filtration plant didn’t go wacko and allow some toxic element to make its way into the taps in our houses.

It’s clear that we trust technology a lot. And with some very important things.

So, it’s interesting that some things that technology can help with seem to automatically send a shiver down our security spines.

Take MicroCHIPs, for instance. They’re a company from Lexington, Massachusetts, whose tagline is “programmable drug delivery” and describe claim to specialise in “intelligent implanted devices designed to improve the health of millions of people”.

According to CNET, MicroCHIPs has developed a tiny chip that can be implanted under a woman’s skin to manage her birth control for up to 16 years.

The chip, which measures just 20 x 20 x 7 millimetres, contains tiny reservoirs – filled with birth control drugs.

MicroCHIPs’ technology is based on proprietary reservoir arrays that are used to store and protect potent drugs within the body for long periods of time. These arrays are designed for compatibility with preprogrammed microprocessors, wireless telemetry, or sensor feedback loops to provide active control. Individual device reservoirs can be opened on demand or on a predetermined schedule to precisely control drug release or sensor activation.

Sounds clever doesn’t it?

And, guess what? You can control the chip wirelessly via a remote control.

So, you had better hope that someone malicious can’t subvert the security in the chip’s wireless communications.

After all, if they are able to control the drug’s release on demand they could potentially either stop the contraception entirely (increasing the chances of pregnancy) or flood the woman’s body with massively higher levels of the drug that could cause illness.

So, would you trust the technology to manage your or your wife’s fertility? Or would you be concerned about (ahem) unauthorised penetration?

It’s not as though security researchers and hackers haven’t shown they can take control of how much insulin is pumped through a patient’s body, or that a former vice-president of the United States wasn’t so frightened of assassination that he had the wireless feature of his implanted heart defibrillator deactivated.

In an interview with Mashable, Robert Farra of MicroCHIPS attempts to reassure the public that the devices are being made with security in mind:

A hacker would have to contact the patient’s skin to reach the device, and all and the commands are sent by radio frequency rather than by Bluetooth. The short range also makes it impossible for a hacker to “listen in,” The short range also makes it impossible for a hacker to “listen in,” Farra says.

The chip has a micro-clock that remembers when the last 30-day reservoir was opened. Even if that failed, the chip’s battery is not strong enough to melt all the seals at once and release the all the reservoirs at the same time.

Farra also says chips will not break in an accident and release drugs because they are strong enough to resist hundreds of pounds of pressure per square inch. They will be implanted in soft parts of the body that offer cushioning, he adds.

Car manufacturers spend millions ensuring that their vehicles are safe to drive, as they know that they would be hit by huge consequences if they had an endemic safety problem. Similarly, there are bodies who keep a close eye on our utility systems to make sure that they are not poisoning us, and hoops that manufacturers must jump through before they can put electrical devices onto the market.

Let us all hope that medical device manufacturers are taking their responsibility to our safety seriously, and teaming up with cybersecurity experts to ensure that their wireless devices are protected from malicious hackers.

Time will tell if MicroCHIPs safety measures will have been sufficient or not. If they’re not, what’s the betting that someone will drily condemn their offspring with a telling name.

Chip, perhaps?

The post “I’ve been hacked, and now I’m pregnant!” appeared first on We Live Security.

Brought by: http://foodonia.com

LastPass security holes found by researcher, says password management firm – but no need to panic | foodonia

LastPass has gone public about a couple of security holes that were found in its popular online password management software.

That’s enough to send a shiver down the spines of the many internet users who trust the service to store its passwords securely, but the company says that there is no need to panic.

In a blog post entitled “A note from LastPass”, the company has given brief details of the flaws found in its password manager for Chrome, Firefox, Opera and Safari.

(By the way, do you feel as cynical as me about how some vendors reporting security vulnerabilities in their products love to downplay the seriousness by not referring to any words like “security” or “vulnerability” in the headlines of their advisories?)

Bookmarklet vulnerability

The first vulnerability isn’t really in the main LastPass product at all, but instead in an add-on known as Bookmarklets.

LastPass Bookmarklets are small snippets of JavaScript code that install as a bookmark of “favourite” in your browser.

Chances are that you would only be using Bookmarklets if you wish to integrate LastPass more tightly with the mobile Safari browser on iOS, or if you weren’t using one of the major browsers that LastPass officially supports.

If you click on a Bookmarklet, you can execute code on the webpage that you’re viewing. That could, of course, be useful if there is a login form on the webpage and no other easy way to access your password manager, but what happens if the webpage you are running the code on is itself malicious?

Zhiwei Li, a security researcher at UC Berkeley, found a method by which (if a user clicked a bookmarklet while visiting an untrustworthy website) passwords for other sites could be extracted from LastPass and put in the hands of criminal hackers.

A research paper by Zhiwei depicts an untrustworthy site tricking a Bookmarklet into revealing the user’s Dropbox password – although this could actually be repeated to extract every password stored in a victim’s LastPass vault.

LastPass says that Bookmarklets are “actively used by less than 1% of the user base”, and is keen to underline that the threat is small, and that it has seen no evidence of malicious exploitation:

“If you are concerned that you’ve used bookmarklets before September 2013 on non-trustworthy sites, you may consider changing your master password and generating new passwords, though we don’t think it is necessary.”

One Time Password (OTP) vulnerability

In this targeted attack, Zhiwei showed that it might be possible to exploit LastPass’s One Time Password (OTP) feature – normally used when a user is logging into their LastPass vault on a computer that they do not trust (such as one that is shared with other users), and that might be harbouring keylogging spyware.

OTPs self-destruct after one use, so even if a malicious hacker grabs the one you use to access your passwords – it shouldn’t be any use to them.

However, Zhiwei demonstrated that if an attacker knew their victim’s LastPass username they could exploit the feature to extract a directory of all the sites for which the user was storing passwords in LastPass. Fortunately, it wouldn’t give hackers access to a users’ actual passwords, but it would allow them to make off with an encrypted copy of the password database and allow them to delete credentials stored in the database.

“Regarding the OTP attack, it is a “targeted attack”, requiring an attacker to know the user’s username to potentially exploit it, and serve that custom attack per user, activity which we have not seen. Even if this was exploited, the attacker would still not have the key to decrypt user data. If you’d like to check your current OTPs you can do so here“

The good news is that the people who found the security vulnerabilities were Zhiwei and his fellow researchers at UC Berkeley, rather than a cybercriminal. Zhiwei is said to have acted responsibly with the information, and – according to LastPass’s statement – the company “doesn’t have any evidence they were exploited by anyone beyond [Zhiwei] and his research team.”

What strikes me as a little unusual about the disclosure of these vulnerabilities is that they were first reported (and indeed patched) back in the fall of last year. It has taken almost a year for them to become public.

LastPass says that Zhiwei only tested the exploits on dummy LastPass accounts, and because it found no evidence of malicious exploitation, and addressed the issues immediately, the company refrained from discussing the research until after it had been published.

All LastPass users should be grateful that the company addressed the security vulnerabilities so quickly, and feel reassured that there is no evidence that anyone’s password vaults were compromised.

Although flaws and issues are found from time to time with password managers, as detailed in Zhiwei’s research which looks at other password management products besides LastPass, I remain a strong believer that for the typical computer user decent password management software is going to be a more secure way of living a life online than relying on their brain and common sense to generate and keep secure their passwords.

Get yourself a password manager, choose a strong, hard-to-crack master password, enable two factor authentication and start taking your online privacy more seriously.

What do you think? Do you trust password management software? Or do you prefer to manage your passwords in a different way? Let us know your opinion by leaving a comment below.

The post LastPass security holes found by researcher, says password management firm – but no need to panic appeared first on We Live Security.

Brought by: http://foodonia.com

Google Drive privacy warning – could yours have leaked data? | foodonia

Shared files sent via Google Drive could have shared more than their senders intended, Google admitted this week – in a Google Drive privacy post where the internet giant admitted that certain file types could be visible to people other than their intended recipients.

Google recently updated Drive with tools to make it more appealing for business, but the storage system is already commonly used in business to share and edit files. Google has issued detailed instructions for Google Drive users who fear they may have shared confidential information.

Google has patched the Google Drive privacy problem, and issued detailed instructions on what file types are affected (files created in other programs and stored unconverted in Google Drive, and shared with ‘anyone who has the link’).

Infoworld says, “Google’s handling of the matter is further evidence that the company has a good nose for how to deal with such exploits. But here’s also hoping Google applies the lessons from this discovery to all its services.”

Google Drive privacy – who can read my files?

Veteran security researcher and We Live Security contributor Graham Cluley, writing on the Intralinks blog, says that the leak, “underlines the unexpected dangers which can arise from allowing “anyone who has the link” to access your private data without further authentication.”

Google’s Drive privacy post explains which files may be at risk – yours are only at risk if they fulfill ALL of the following conditions;

1. The file has to have been uploaded to Google Drive, and shared with ‘anyone who has the link’


2. It has to have remained in its original format (ie .docx), without being converted to Google Drive formats such as Docs


3. It has to have contained links to third-party HTTPS websites

If this is the case, admins on the third-party website may have been able to see a URL which allowed them to click through to sensitive data.

Cluley points out that in certain business scenarios – such as corporate takeover bids – this could plausibly have resulted in the target of such a bid being able to read the details freely online.

What do do if you’re worried about Google Drive privacy

Google has patched the issue – so that any documents shared via the service going forward will no longer be affected by the privacy problem.

This, however, does not affect documents that have already been shared via the service. Google Technical Program Manager Kevin Stadmeyer advises, “If one of your previously shared documents meets all four of the criteria above, you can generate a new sharing link with the following steps:

1. Create a copy of the document, via File > “Make a copy…”


2. Share the copy of the document with particular people or via a new shareable link, via the “Share” button


3. Delete the original document.

In its guide to using Google Drive privately, the company advises users to make sure that documents are shared correctly – i.e. users should think carefully about whether ‘anyone who has the link’ is an appropriate setting for a confidential file…

The post Google Drive privacy warning – could yours have leaked data? appeared first on We Live Security.

Brought by: http://foodonia.com

How to remove your house from Google Street View | foodonia

Former British Prime Minister Tony Blair, septuagenarian former mop-top Sir Paul McCartney and disgraced former RBS banker Fred Goodwin are just some of the public figures who are said to have successfully convinced Google to change Street View pictures of their homes into a bunch of blurred pixels.

But what are you supposed to do if you’re not a political statesman, a crinkly crooner or an executive who oversaw the largest annual loss (£24.1 billion) in UK corporate history?

How are YOU supposed to remove your house from Google Street View if you don’t like the idea that Google drove one of its Street Cars up your road, took a photo of your front door without your permission, and then published it on the net?

Well, fortunately there is a way. And it should work not only if you are trying to remove your hose from Google Street View, but also if you want the search giant to blur out a face, a vehicle or another object.

1. Firstly, locate your address on maps.google.com. You do this simply by typing in the address into the search box, and pressing enter.

There should be a red pin-tack shown on the screen representing your home on the map.

You now need to make sure you are in Street View mode. You can do that by finding the Street View icon (represented by a stick man) in the lower right hand corner of the screen, and clicking on the map.

2. Use the left and right arrow controls with your mouse to adjust the Google Maps Street View, until you get a clear view of your house.

Once you’re happy the view represents your house, click on the “Report a Problem” link in the bottom right-hand corner of the screen.

You’re almost done. A new webpage is displayed, showing a street view of what Google believes you wish to raise a concern about. This is your final opportunity to adjust the view.

3. At this point you can tell Google what you wish to be blurred – a face, your home, a car or license plate, or a different object – and explain the area of concern.

Google will ask you for a contact email address and requests that you complete a CAPTCHA to verify that you are a human rather than a bot developed by privacy campaigners trying to sabotage Google Street View.

Click the Submit button.

4. You have done it. Now you just have to wait and see.

Tony Blair, or presumably one of his staff, went through the process and has successfully excised the image of his Georgian home in London.

Will you be as successful as Tony Blair at getting a photo of the front of your house obscured from Google Street View? You can only hope that Google will honour your right to privacy.

At the time of writing my own front door is still visible on Street View, a week after I first requested its pixellation.

Of course, there are other solutions if you don’t like Google Street View showing the world a picture of your house.

For instance, Google CEO Eric Schmidt glibly told those who were concerned to “just move” if they didn’t like Google having a street view picture of their home.

Hardly a practical solution, I’m sure you would agree. Schmidt later claimed that he “misspoke” by making that remark – but I wondered if he had taken the advice himself.

After all, according to Forbes, Google CEO Eric Schmidt recently purchased a $22 million mansion in the Holmby Hills neighbourhood of Los Angeles, within spitting distance of Hugh Hefner’s Playboy mansion.

As you can see – he doesn’t appear to have blurred out Google Street view images of his home. Mind you, it’s not as if you can actually see his home from the road.

Schmidt, you will remember, was the guy who back in October 2010 made the hairs stand up on the back of privacy-conscious internet users’ necks when he declared:

“Google policy is to get right up to the creepy line and not cross it”

Oh well, that’s reassuring…

The post How to remove your house from Google Street View appeared first on We Live Security.

Brought by: http://foodonia.com

Elite force of ‘cyber cops’ to be trained by Europol | foodonia

Top police cybercrime experts from 22 European countries are to participate in a 10-day intensive training course in Spain starting this week – becoming, in the words of the head of the European Cybercrime Centre, “cyber cops”.

The hands-on course will last 10 days. It follows a nine-week training course where the police experts have been challenged online by experts from other cybercrime divisions and academia, according to V3’s report.

Troels Oerting, Head of EC3 said in a statement: “Today we have 37 more cybercrime experts joining the growing group of cyber cops and more will follow. We might have started a bit late – but we are catching up fast, and will continue to invest in this area to do our part in keeping the Internet open and transparent but also safe.”

Oerting described the challenges that the newly qualified “cyber cops” are facing as “overwhelming” - noting that organized crime has now made a home in cyberspace.

Oerting said, ““This high level training course held in impressive surroundings offered by the Spanish Police is an important contribution to the improved readiness in many countries to prevent and combat cybercrime. We need all hands on deck in order to match the overwhelming crime perpetrated in cyberspace by organized criminal networks and we need real experts in order to be able to detect, identify and hunt down these criminals.”

This the second year where EC3 has run an intensive training course for police cybercrime experts.

Spanish National Police Commissioner Ignacio Cosidó Gutiérrez said that international cooperation was vital in the battle against cybercrime.

Gutiérrez said, ““International police cooperation, capacity building, public-private partnership and a network of specialised police officers are key elements in the fight against cybercrime.”

The post Elite force of ‘cyber cops’ to be trained by Europol appeared first on We Live Security.

Brought by: http://foodonia.com