Android vulnerabilities 'increasing'

Android vulnerabilities, increased online banking threats and availability of sophisticated, inexpensive malware toolkits are among the growing concerns cited as major cyber-security threats in a report.

Trend Micro's Q2 2013 Security Roundup Report describes cyber-security threats from the previous quarter combined with analysis to evaluate and anticipate emerging attacks.

The report showed the number of malicious and high-risk Android apps has grown to 718,000 in the second quarter – a massive increase from the 509,000 high-risk apps found in the previous quarter.

These malicious apps are on track to exceed one million by year's end, as predicted by Trend Micro in the 2013 forecast. By way of comparison, it took a decade for PC malware to amass this number, said a statement.

Linda Barrabee, research director, Connected Intelligence at The NPD Group, said approximately only 30 per cent of all Android smartphones and tablets in the US, have any type of security app installed.

"Due to the fractured nature of the Android network, it is very difficult for patches to reach all users in an effective timeframe. In some cases, users will never get patches as vendors leave their customers at risk of attack," said JD Sherry, vice president, technology and solutions, Trend Micro.

"Until we have the same urgency to protect mobile devices as we have for protecting PCs, this very real threat will continue to grow rapidly. To fight this, Android users need to take great care when using their devices and take the simple, but effective, step of adding security software to all mobile devices."

The report also warned of increasing hazards to online banking, which saw malware increasing 29 per cent from the previous quarter. The US was the top target of malware, with more than one million instances amounting to 28 percent of global compromises, followed by Brazil at 22 percent and Australia at five percent.

Preventative measures, such as closely monitoring account activity and using third-party security solutions, will help mitigate this growing threat, said the report.

The report found that malware toolkits are being sold via inexpensive, free or bundled pricing schemes, such as two-for-one packages. The ease of access to these effective malware toolkits increases the hazards Internet users will face going into the remainder of 2013 and beyond, it said.
- TradeArabia News Service

The five scariest hacks we saw last week

(CNN) -- If something can connect to a network, it can be hacked. Computers and phones are still popular targets, but increasingly so are cars, home security systems, TVs and even oil refineries.

That was the message at this year's Black Hat and DefCon computer security conferences, which took place last week in Las Vegas. The annual conferences draw a mix of computer researchers and hackers who present the latest bugs and vulnerabilities they've discovered. It's a combination of public service, business and sport.

These are some of the more popular targets covered at this year's conferences. By drawing attention to them, the "white-hat" hackers hope to encourage greater security from the various manufacturers and industries, and more vigilance from consumers.

Typically, the presenters inform manufacturers of bugs ahead of their talks so the companies can fix the issues before they are exploited by criminals.

Remote-controlled cars

Someone hacking your computer can be an inconvenience. Someone hacking your car can be deadly.

A pair of presentations on hacking cars kicked off the DefCon conference on Friday. Australian hacker Zoz outlined the security issues fully autonomous cars will face and said car-hacking is inevitable.

Autonomous vehicles like cars and drones are essentially robots, and they rely on sensors to operate. He said a hacker could theoretically take complete control of a car over wireless networks or trick its various sensors into feeding a motorist false information about location, speed and the proximity of other cars or objects.

Fully driverless cars are still a few years away, but computerized systems are common in vehicles on the road today. Electronic control units can control a range of car functions, including braking, accelerating and steering. They manage security features, in-car displays and even seat belts.

Researchers Charlie Miller and Chris Valasek, funded by a grant from the U.S. military's DARPA, looked into what kind of damage hackers could do to a car by taking control of a Toyota Prius and a Ford Escape.

To access the systems, they had to physically connect a computer to the cars through a diagnostics port. They wrote custom software that let them hijack the cars' systems.

Once in control, they disabled brakes, changed the display to show incorrect speed or gas levels, and messed with the steering and seat belts. They were able to kill the engine and toy with with less consequential features like the car's horn and lights.

Toyota played down the wired demonstration and said it is focusing on security measures to prevent wireless attacks.

Compromising smartphones

Attacks on personal computers used to be the bread and butter of cybercriminals, spawning a lucrative industry of black-market malware and the anti-virus programs that fight them.

The next big target is smartphones. Mobile devices are not impervious to attacks, even though walled-off app stores have kept much of the malware at bay.

Kevin McNamee demonstrated how a piece of malware could turn an Android smartphone into a "spy phone" that remotely monitors its owner, sending information on the location, communications and content, like photos, back to a third party.

The hack isn't new, but McNamee managed to inject the malicious code into popular apps like "Angry Birds." Once it was installed, the user would have no idea that their phone was acting as a remote surveillance device.

Verizon "femtocells" -- small boxes used to extend cell service --were hacked by security researchers at iSEC Partners to intercept calls and any other data sent over cellular networks like texts, images and browsing history. The wireless carrier issued a fix for all its femtocells, but researchers say other networks could still have the same issue.

With $45 in hardware, researchers Billy Lau, Yeongjin Jang and Chengyu Song turned an innocent-looking iPhone charger into a tool for gathering information such as passcodes, e-mails and other communications, and location data directly from the smartphone. Apple thanked the researchers and said it is deploying a fix for the bug in its iOS 7 software update, which comes out this year.

The too-smart home

Thanks to cheap, low-power sensors, anything in your house can become a "smart" device, helpfully connecting to the Internet so you can control it from a computer or smartphone. Smart home security devices have the potential to cause the most damage if hacked, and two separate demonstrations showed how to break in by opening "smart" front-door locks.

Another unsettling trend at the conferences was spying on unwitting people through their own cameras. Home security cameras could be disabled by someone who wanted to break in, or they could be turned into remote surveillance devices. One researcher showed how she easily took over the camera stream on a child's toy from a computer.

Researchers Aaron Grattafiori and Josh Yavor found bugs in the 2012 model of the Samsung Smart TV that allowed them to turn on and watch video from the set's camera. Samsung said it had released a software update to fix the issue. (Many security experts suggest placing a piece of tape over any cameras you don't want surreptitiously watching you, just to be safe.)

Hackers get personal

Even in the wake of this year's NSA revelations, a homemade surveillance device that sniffs out pieces of data from your various computing devices, even when they're not online, is disturbing.

Brendan O'Connor, who runs a security firm and is finishing a law degree, has created such a device, dubbed CreepyDOL (DOL stands for Distributed Object Locator; "Creepy" is self-explanatory). The device cost $57 to make and consists of a Raspberry Pi computer, a USB hub, two WiFi connections, an SD card and USB power inside an nondescript black case.

Computers and phones act as tracking devices and leak information constantly, according to O'Connor. When plugged in, CreepyDOL detects nearby phones and computers and uses them to track people's location and patterns, figuring out who they are, where they go and what they do online.

To demonstrate the device without breaking any laws, O'Connor showed his own information as sniffed out by one of the devices. Using a gaming engine and Open Street Maps, he hovered over his dot on a map. It brought up his name, e-mail address, a photo, the dating website he used, details about his devices and the locations he visited in town.

In a worst-case scenario, as imagined by O'Connor, a miscreant could plug in one of the devices under any Starbucks near a capital building to pick up the scent of a state senator and wait for them to do something compromising.

"You find somebody with power and exploit them," said O'Connor.

The creation is remarkable for how simple it is. It's likely others have similar knowledge and setups that exploit the same security flaws in applications, websites, devices and networks.

Industrial facilities

The most frightening targets highlighted at the conference were the opposite of personal.

Critical infrastructure such as oil and gas pipelines or water treatment plants are potential targets for hackers. Many industries are controlled with supervisory control and data acquisition, or SCADA, systems.

The systems are older, installed at a time when people weren't concerned about cyberattacks, and connect to the Internet over an unsecured network protocol.

The reason the systems are online in the first place is so that they're easier to monitor. Some, like oil pipelines, are often in remote locations.

Multiple demonstrations at the conferences showed just how simple it is to hack energy systems.

Researchers Brian Meixell and Eric Forner staged a mock hack of an oil well using pumps and a liquid container filled with teal liquid. They got into the system, turned the pumps on and off and overflowed the containers by feeding the system false data. If it happened on an actual oil well, the hack could result in an environmental catastrophe, according to the researchers.

It's possible to shut down an entire industrial facility from 40 miles away using a radio transmitter, according to researchers Carlos Penagos and Lucas Apa. They demonstrated injecting fake measurements, causing the device that received them to behave differently. For example, someone could trigger a water tank to overflow by faking an abnormally high temperature.

The industries and U.S. government are aware that industrial systems are vulnerable, but their remoteness and age make upgrading difficult and expensive. There is no built-in system for releasing software patches, like there is with personal computers.

By Heather Kelly, CNN

Microphones of Android phones can be remotely activated: Former US official

Former US official noted that sophisticated hacking tools can remotely activate the microphone on an Android device to spy on anyone.

Google Android mobile operating system has been the constant target of the hackers and Google's team has worked hard to patch all possible holes. However, there are perhaps several workarounds in Android that are not publicly talked about. Now according to a report of The Wall Street Journal, a former US Government official said that the Federal Bureau of Investigation uses sophisticated tools that can remotely activate the microphone on the Google Android based devices.
As per the report, the FBI uses some internally developed tools to collect information from the cyber space, computers and even mobile phones with the help of some private companies.

There are tools that can remotely activate the microphone on any Android OS running smartphone and the conversations can be recorded. This can be done remotely and the user would have no clue about it. This is just one of the methods that have been revealed. It is quite possible that any legitimate third party app can access the data on the phone and pass it on over the mobile internet without the knowledge of the user. Everything lies deeply under the permissions allowed to particular app.

Businesses Lack Security Knowledge, Vulnerable to Malware Threats

The majority of respondents have seen an uptick in more sophisticated and targeted malware attacks over the last 24 months.

The most likely avenue for a malware attack, and cause for successful malware attacks, is lack of user knowledge about cyber-security risks, according to a survey of 315 North American-based IT security professionals working at enterprise-class organizations (1,000 employees or more) sponsored by Malwarebytes and conducted by Enterprise Strategy Group (ESG).

The study also revealed that enterprise organizations are seeing an increase in more sophisticated malware and are making it a strategic priority to add new layers of endpoint security to protect their organizations against advanced zero-day and polymorphic threats commonly used for targeted attacks.

"As cyber-attacks become more sophisticated, IT security professionals are realizing that relying on only one layer of endpoint security isn't enough. Each endpoint needs multiple layers of malware detection to ensure complete protection," Marcin Kleczynski, CEO of Malwarebytes, said in a statement. "The reality is, most antivirus products will miss nine out of 10 zero-day malware threats, and having a layered approach blocks advanced threats that traditional antivirus scanners may fail to detect."

The ESG report found the majority of respondents have seen an uptick in more sophisticated and targeted malware attacks over the last 24 months. However, 62 percent of organizations surveyed said endpoint security software is not effective for detecting zero-day and/or polymorphic malware, which leaves them vulnerable to these attacks

Likely avenues for malware to compromise an organization’s system included employees opening an infected e-mail attachment and unwittingly clicking on an infected URL while surfing the Web. Survey respondents indicated an employee clicking on an infected URL posted within an e-mail was the most likely vector for malware to infiltrate their organizations.

On average, it took 57 percent of respondents hours to detect that an IT asset had been compromised by malware. It took 19 percent of organizations several days to determine there had been an attack, and 29 percent of respondent organizations that have suffered a successful malware attack believe the increasing use of social networks is responsible for those attacks.

In addition, two-thirds of U.S.-based respondents do not believe the U.S. federal government is doing enough to help the private sector cope with the current cyber-security and threat landscape, and 85 percent of IT security professionals expressed concern about some type of massive cyber-attack that could impact critical infrastructure, the economy and/or national security.

"When it comes to managing malware risk, enterprises would be best served by implementing a layered approach using proactive and reactive lines of defense through their networks. Antivirus software plays a key role in protecting organizations, but it should not be the only method used to deter malware attacks," Jon Oltsik, senior principal analyst at ESG, said in a statement. "Additionally, sometimes the biggest vulnerability in an organization is the computer users. Because employee actions can greatly impact computer security, educating employees on potential threats and how to avoid them should be made a priority."

By Nathan Eddy

Forensic Imaging system exposes critical data

A breakthrough from US Forensic Imaging company CyanLine has allowed investigators to reveal the true number of times a hard disk has been in active use and when it was first activated.

CyanLine's  Fast Disk Acquisition System (FDAS) exposes vital metadata from the disk controller that reveals information previously thought unavailable.

“The discovery of this new information can be utilised in nearly every case that uses computer forensic imaging as evidence,” said Steven Branigan, founder of CyanLine and forensic scientist. “The information from FDAS can be used to confirm or overturn cases, if the metadata aligns with their claims.”

Cyber crime suspects can buy brand new drives and copy only the ‘evidence’ they want investigators to see, according to Branigan.

“Forensic investigators can search a suspect’s metadata, and if they find that the drive was in use for just 20 hours, but the computer is three years old, it shows that evidence was not only tampered with, but it was also hidden elsewhere,” he added.

Branigan states that the biggest problem in digital forensics cases are that lawyers and investigators have not known to look for metadata, nor realise that suspects can and will replace their disk drives to hide evidence.

“FDAS not only provides a faithful copy of the evidence disk, but it also provides information about the disk drive itself. It is this data can be used to determine age and usage of the disk,” Branigan said.

Lawyers and investigators can now use FDAS to confirm that the data under review is, in fact, the right data.

CyanLine says that FDAS is the only forensic imaging system that reports on this key metadata, which not only adds value, but also offers evidence that can crack and close a case. For more information, visit http://www.cyanline.com.

SIM Cards Vulnerable to Hacking...

Millions of mobile phones may be vulnerable to spying due to the use of outdated, 1970s-era cryptography, according to new research due to be presented at the Black Hat security conference.

Karsten Nohl, an expert cryptographer with Security Research Labs, has found a way to trick mobile phones into granting access to the device's location, SMS functions and allow changes to a person's voicemail number.

Nohl's research looked at a mobile phones' SIM (Subscriber Identification Module), the small card inserted into a device that ties it to a phone number and authenticates software updates and commands sent over-the-air from an operator.

More than 7 billion SIM cards are in use worldwide. To ensure privacy and security, SIM cards use encryption when communicating with an operator, but the encryption standards use vary widely.

Nohl's research found that many SIMs use a weak encryption standard dating from the 1970s called DES (Data Encryption Standard), according to a preview posted on his company's blog.

DES has long been considered a weak form of encryption, and many mobile operators have upgraded now to more secure forms. It is relatively easy to discover the private key used to sign content encrypted with DES.

In its experiment, Security Research Labs sent a binary code over SMS to a device using a SIM with DES. Since the binary code wasn't properly cryptographically signed, it would not run on the device.

But while rejecting the code, the phone's SIM makes a crucial mistake: it sends back over SMS an error code that carries its own encrypted 56-bit private key, according to the company. Because DES is considered a very weak form of encryption, it's possible to decrypt the private key using known cracking techniques.

Security Research Labs did it in about two minutes on a regular computer with the help of a rainbow table, a mathematical chart that helps convert an encrypted private key or password hash into its original form faster.

With the private DES key in hand, it is then possible to "sign" malicious software updates with the key, and send those updates to the device. The device believes the software comes from a legitimate source and then grants access to sensitive data.

The company outlined an attack scenario against SIM cards that run some form of Java virtual machine, a software framework for Java applications.

Using the SIM's private key, an attacker could force the SIM to download Java applets, which are essentially very small programs that perform some function. Those applets would be "allowed to send SMS, change voicemail numbers, and query the phone location, among many other predefined functions."

"These capabilities alone provide plenty of potential for abuse," the company wrote.

Possible remedies to the problem including ensuring SIM cards use state-of-the-art cryptography and also using Java virtual machines that restrict applets' access to certain information.

Nohl's presentation, "Rooting SIM cards," will take place at the Black Hat security conference in Las Vegas on July 31.

By Jeremy Kirk

By Jeremy Kirk

Millions of mobile phones may be vulnerable to spying due to the use of outdated, 1970s-era cryptography, according to new research due to be presented at the Black Hat security conference.
Karsten Nohl, an expert cryptographer with Security Research Labs, has found a way to trick mobile phones into granting access to the device's location, SMS functions and allow changes to a person's voicemail number.
Nohl's research looked at a mobile phones' SIM (Subscriber Identification Module), the small card inserted into a device that ties it to a phone number and authenticates software updates and commands sent over-the-air from an operator.
More than 7 billion SIM cards are in use worldwide. To ensure privacy and security, SIM cards use encryption when communicating with an operator, but the encryption standards use vary widely.
Nohl's research found that many SIMs use a weak encryption standard dating from the 1970s called DES (Data Encryption Standard), according to a preview posted on his company's blog.
DES has long been considered a weak form of encryption, and many mobile operators have upgraded now to more secure forms. It is relatively easy to discover the private key used to sign content encrypted with DES.
In its experiment, Security Research Labs sent a binary code over SMS to a device using a SIM with DES. Since the binary code wasn't properly cryptographically signed, it would not run on the device.
But while rejecting the code, the phone's SIM makes a crucial mistake: it sends back over SMS an error code that carries its own encrypted 56-bit private key, according to the company. Because DES is considered a very weak form of encryption, it's possible to decrypt the private key using known cracking techniques.
Security Research Labs did it in about two minutes on a regular computer with the help of a rainbow table, a mathematical chart that helps convert an encrypted private key or password hash into its original form faster.
With the private DES key in hand, it is then possible to "sign" malicious software updates with the key, and send those updates to the device. The device believes the software comes from a legitimate source and then grants access to sensitive data.
The company outlined an attack scenario against SIM cards that run some form of Java virtual machine, a software framework for Java applications.
Using the SIM's private key, an attacker could force the SIM to download Java applets, which are essentially very small programs that perform some function. Those applets would be "allowed to send SMS, change voicemail numbers, and query the phone location, among many other predefined functions."
"These capabilities alone provide plenty of potential for abuse," the company wrote.
Possible remedies to the problem including ensuring SIM cards use state-of-the-art cryptography and also using Java virtual machines that restrict applets' access to certain information.
Nohl's presentation, "Rooting SIM cards," will take place at the Black Hat security conference in Las Vegas on July 31.
- See more at: http://www.computerworld.in/news/sim-cards-vulnerable-hacking-research-120732013#sthash.oJOyPach.dpuf

Digital Carjackers Show Off New Attacks

Cyber Security Threats...

Employees bigger cyber security threat than dedicated criminals

Over half of business leaders see their own employees as a bigger threat to cyber security than external attackers, according to the survey ‘Boardroom Cyber Watch 2013'.

The survey, delivered by IT Governance, collated the views of 260 senior executives from across the globe, representing organisations ranging in size and revenue from US $5 million to US $500 million. 

Perhaps surprisingly, despite recent high-profile cases of external hackers derailing government and corporation IT systems, employees are seen as the biggest threat to an organisation's cyber security - being the number one threat chosen by 53 per cent of respondents.

A more modest number, at 27 per cent, consider cyber criminals their number one threat. State-sponsored cyber-attackers (12 per cent) and rival organisations (8 per cent) followed.

Worryingly, a quarter of all respondents admit to facing a cyber attack in the last 12 months alone, whilst a further 20 per cent concede that an attack in the last year may have occurred. Despite this, only 30 per cent of the senior executives questioned properly value the need for an understanding of IT security vulnerabilities when hiring executive staff.

Alan Calder, Chief Executive of IT Governance, commented on the findings: “In the face of the rapid development and deployment of new cyber-threats, such infrequent executive oversight of IT security status seems alarmingly casual.

"In the boardroom, many companies still appear too removed from the action for directors to meet their governance obligations.”

To provide an incentive to brush up on cyber security, the survey has revealed that half of the companies have been asked by customers about information security measures in the past 12 months - a more proactive attitude that could provide a competitive advantage if followed.

Calder explained: “The best way for organisations to prove their cyber security credentials is to comply with, and be certificated against, ISO 27001, the global best practice standard for information security management. This lets you signal to customers anywhere in the world that you have a robust method for addressing the entire range of risks associated with systems, people and technology."

By: Information Daily Staff Writer 

Google issues security patch for Android devices

SYDNEY: Search engine Google has reportedly issued a patch to mend the security flaw detected by security firm BlueBox which made almost all Android phones vulnerable to hacking. 

As revealed earlier by the security firm, Android uses the cryptographic signature as a way to check that an app or program is legitimate and to ensure it has not been tampered with, however, BlueBox found a method of tricking the way Android checks these signatures so that malicious changes to the apps go unnoticed. 

According to News.com.au, Google has released a patch to original equipment manufacturers in a bid to address the bug which reportedly affected up to 900 million Android devices since the release of Android 1.6 in 2009. 

Google's Android Communications Manager, Gina Scigliano said that there has not been any evidence of exploitation in Google Play or other app stores because of the loophole. 

The report said that while the security hole exists, there is no indication that it has yet been exploited and Android users can manually check for system updates through the settings menu or can rely upon their hardware providers for the update.

7 Things Every CEO Should Know About Information Security

                   
                         

Physical & Information Security Awareness Cartoon (Social Engineering)

Employee Security Awareness

A section of security breaches are caused by employees, whether accidentally or deliberately. To prevent security breaches of any kind, organizations should strengthen and solidify all their security systems and technologies. Here listed are a few simple ways to make employees understand and feel responsible for security of the Company's assets.

Encryption can’t protect your data while you’re logged in

You carry a lot of data and sensitive information on your laptop, tablet, and smartphone. The standard method of protecting that information from prying eyes is to encrypt it, rendering the data inaccessible. But with most encryption software, that information becomes accessible the moment you log in to the device as a matter of convenience.

Think about what information that might be: names, postal and email addresses, and phone numbers for friends, family, clients, and business associates; calendar events indicating where you’ll be and when you’ll be there; personal photographs; and more. You might also have proprietary information about your company, clients, information that companies have entrusted you under the terms of non-disclosure agreements, and other sensitive information that should be secured.

Encrypting data protects it from unauthorized access.

Encryption basically scrambles the data so it’s nothing but unusable gibberish to anyone who isn’t authorized to access or view it.

And that’s great, but ask yourself this: How many steps must you go through to decrypt your data? Encryption is designed to protect data, but it should also be seamlessly accessible to the user—it should automatically decrypt, so you don’t have to jump through hoops to use your own encrypted data. And that means it’s not protected at all if someone finds your laptop, smartphone, or tablet in a state that doesn’t require a log-in password.

Using a Passcode

The Department of Justice and the National Security Administration—the same NSA that allegedly has omnipotent access to all data everywhere—have expressed frustration over iOS 6 and declared its encryption to be virtually impenetrable. There is a way to bypass it, but only Apple knows the magic trick, and there’s a massive backlog of requests from law enforcement.

Remote lock and wipe capabilities are no security or privacy panacea.

There is also a general layer of encryption in iOS that functions purely as a means of remotely wiping the device running it. Rather than literally erasing all of the data—which would take a little time depending on how much data there is—this remote wipe tool simply resets the encryption key, instantly rendering the data useless. That’s handy, but it’s not foolproof.

iOS devices also have hardware-based encryption that protects your data, including your email and its attachments. That encryption, however, is tied to a passcode, meaning you must actually assign and use a passcode for your iOS device in order for your data to be protected.

The BitLocker encryption in Microsoft Windows works along the same lines. The TPM (Trusted Platform Module) chip provides a hardware-based element, and the user login provides the key to unlock the encryption and make the data available to the user.

All popular encryption tools lock data from unauthorized access, but are designed to unlock when a user successfully logs in. The data is then available as if it weren’t encrypted at all, and the user doesn’t have to take any additional steps to access or use the encrypted information.

But what if you’re already logged in?

Can you see the problem with this approach? This feature designed to make encryption more convenient renders the data protection impotent as long as you’re logged in.

Tripwire Director of Security Operations Andrew Storms explains, “If a thief catches your device in an unlocked state, they have a potential window of opportunity to access the data stored on that device.”

The best way to secure data is to configure your mobile devices to require passcodes after short periods of nonuse.

That “virtually impenetrable” iOS encryption relies on your device being locked with a passcode. When you set a passcode in iOS, you can choose whether the device should require the passcode immediately, or in one minute, five minutes, 15 minutes, or even an hour. An hour! If you choose that setting, you’re basically leaving your “encrypted” data exposed to potential compromise for 60 minutes.

The best way to secure the data on your mobile device is thus to configure the device to require a passcode after a relatively short period of nonuse. Set the time limit too short, and you’ll find yourself becoming irritated by repeatedly having to retype your passcode. Leave it unlocked for too long and you give a thief plenty of time to access all your supposedly encrypted data.

According to Tripwire CTO Dwayne Melancon, “In an enterprise environment, a lot of these complementary policies can be driven using group policies—for example, requiring screen locking, passwords upon waking, and setting short timeouts for automatic locking and automatic locking when the lid of a laptop is closed.”

While iOS and other mobile devices—as well as many other encryption tools—provide the ability to remotely lock or wipe the data from a device, that tool is useful only if you realize the device is gone. Every second your laptop, tablet, or smartphone remains unlocked while it’s out of your control is time that your encryption is not doing anything to protect your data.

Tripwire’s Storms points out that remote lock and wipe capabilities are no panacea: “On mobile devices, a clever thief will immediately disable all network access, so the device is unable to receive that remove lock or kill switch signal from corporate administrators.”

A better alternative to timed lockouts might be to have some sort of Bluetooth, NFC (near-field communication), or other close-proximity wireless device that pairs with your laptop, tablet, or smartphone. Keep this device on your person, and if you move too far away, your mobile device will automatically lock to prevent unauthorized access.

Facebook follows Google with super-tough encryption technique most services don't use

Demand for encryption apps has increased dramatically ever since the exposure of massive internet surveillance programs run by US and UK intelligence agencies. Now Facebook is reportedly moving to implement a strong, decades-old encryption technique that's been largely avoided by the online services that need it most.

Forward secrecy (sometimes called "perfect forward secrecy") is a way of encrypting internet traffic — in this case the connection between a website and your browser — so that it's harder for a third party to decrypt the pages being viewed, even if the server's key becomes compromised. It's been lauded by cryptography experts since its creation in the early 1990's, yet most "secure" online services like banks and webmail still don't use it. Speaking with a person familiar with the company's plans, CNET reports Facebook is currently working on implementing forward secrecy, and intends to roll out the feature to its users.

Normally, unencrypted web traffic (HTTP) can be viewed by anyone looking at it as it flies by, as NSA and GCHQ reportedly do while intercepting data from fiberoptic cables. A site supporting HTTPS connections (seen as a "lock" icon in your browser) blocks this eavesdropping by using a shared encryption key between your browser and a web server to protect data while it's in transit.

With regular HTTPS connections, those key exchanges are protected by a single "master" (private) key held by the server, which is fine unless the server's key is compromised; sites using forward secrecy exchange keys differently, so that a criminal or an intelligence agency sucking up internet traffic can't retroactively decrypt all of the site's communications if they get the server's private key.

In 2011, Google became one of the only major sites to implement forward secrecy, and was later joined by Bloomberg.com, as Michael Horowitz notes in his explanation inComputerWorld. Other services still lag behind, likely due to the impact the enhanced "handshaking" process has on performance. CNET says that Facebook intends to make the switch "soon."

Advanced Security Features on Facebook

Using Google 2-Step Verification

With 2-step verification, you'll sign in to your Google Account with both your password and a code that you'll get from your phone. 2-step verification significantly reduces the chances of a bad guy breaking into your account.

Android phone a huge hacking risk

NINETY-nine per cent of all Android devices are vulnerable to hacking or being completely taken over remotely by cyber criminals. 
 
This is the claim of a study by BlueBox security, a mobile security company which claims it has discovered a flaw in the operating system of almost all Google phones and tablets (which runs on the operating system Android) that allows hackers to modify its code in a way that "turns any legitimate application into a malicious Trojan" virus.
The company claims this vulnerability exists on any Android phone or tablet released over the last four years, affecting approximately 900 million devices.
According to the researchers the issue is central to Google's open source operating system and so far only one device has been patched.

The way it works:

Rather than creating a malicious app, cyber criminals wait for legitimate apps to be approved for sale and then go in and modify the code after and create an exploit that allows them to take over people's phones via the app. This flaw would allow hackers to access your passwords, credit card information, emails, any information you store on your phone.
"The implications are huge!," Blue box wrote on its website.
"Depending on the type of application, a hacker can exploit the vulnerability for anything from data theft to creation of a mobile botnet."

So far it appears though this flaw only affects non Google apps, considering the amount of third party apps that exist in the Google store that's hardly a paltry number. There is also no evidence that this flaw has been exploited by anyone.
Google declined to comment. The claims come less than six months after it was revealed by a Sydney developer that every time you purchase an app on Google Play, your name, address and email is passed on to the developer. Last year antivirus company Trend Micro recorded 350,000 security threats on Android devices.

So what can I do about this?

- Do not allow apps from unkown sources. To do this go to Settings, Security and untick "allow unknown sources".
- Well, the news isn't good. Until further notice, news.com.au recommends that you don't download any non-Google apps.
- Bluebox has recommended that users update their operating system to the latest version.
- Also, if you have any apps which store your personal information such as credit card or PayPal information (like eBay, Amazon or Etsy), you should remove this information immediately.
- Remove any personal information from your phone (do you have your credit card pin stored in your notes? Get rid of it).

F-Secure finds an Android hacking app that steals PC data

Steals information when a user connects the device via USB to a Windows machine

SECURITY FIRM F-Secure has discovered an Android app that turns a mobile device into a hacking tool that is capable of stealing information from a connected Windows PC.
The company said in a blog post today that its security response analysts came across the app in an analysis on a Chinese language forum over the weekend. It found that, when executed, the sample, which is detected as "Hack-Tool:Android/UsbCleaver.A", installs an app named USBCleaver on the victim's device.

When that app is launched, it directs the user to download a ZIP file from a remote server, and then unzips the downloaded file to "/mnt/sdcard/usbcleaver/system folder".
The files saved are utilities used to retrieve information when the user connects the device via USB to a Windows PC machine, and can grab browser passwords along with stored WiFi keys and network information.

"To run the utilities, the sample creates an autorun.inf and go.bat file at '/mnt/sdcard'," F-Secure explained in a Labs blog post. "When the device is connected to a Windows computer, the autorun script gets triggered, which then silently runs the go.bat file in the background, which in turn runs the specified files from the usbcleaver/system folder."

The collected details are stored on the device at "/mnt/sdcard/usbcleaver/logs" and can be viewed in the "Log Files" button to view the information retrieved from the PC.
F-Secure said that this attack can be blocked by disabling Autorun by default, as doing so can block USBCleaver's Windows infecting routine.

"This isn't the first Android trojan reported this year with PC infecting capabilities, since that 'distinction' belongs to the trojan-spy apps family we detect as Sscul," F-Secure warned.
"Unlike the Sscul malware however, which is more focused on remote eavesdropping, USBCleaver seems to be designed to facilitate a targeted attack by gathering details that would be helpful in a later infiltration attempt."

How cybersecurity is becoming a priority for private companies

What are the threats?

The biggest threat facing our digital information is foreign governments trying to penetrate our systems for intelligence from which economic value can be gained. A great deal of proprietary information, such as designs and ideas for new products, is being stored on company servers. If that information were extracted, it could offer a competitive advantage.

The common thought used to be that a cyberattack would result in a company’s website going down. A hacker looking to make a name for him or herself would attack a site by bombarding it with bogus traffic, and it would cease to function. Now, hackers are looking to stay behind the scenes because the data they gain can be a lot more valuable than shutting down a site.

What could be the extent of the damage?

In extreme cases, a data breach could trigger the complete downfall of a company. Depending on the nature of the attack, a breach could cause customers to lose trust in the company and its brands. That’s in extreme cases. In other instances, valuable intellectual property could be lost and the associated R&D investment would be hard to recoup.

How can a company recognize its exposure to cyberthreats?

Many times exposures come from within the company, so it’s important to understand what employees are working on and who has access to what data.
Also, consider the risk when an executive travels overseas. When using his or her smartphone, it’s possible software can be downloaded on the phone without his or her knowledge. When that person comes back and connects to his or her office network, the software that was downloaded could penetrate into his or her network.

What are some critical components of good cybersecurity?
It’s important to establish layers of protection. For example, set criteria for employees to access certain company information on its servers. Similarly, companies should employ hardware in layers in order to protect critical data. There are hardware devices designed specifically to stop distributed denial-of-service attacks.

Intrusion protection systems can detect when someone penetrates a company’s network and identify who, where and how. Firewalls also are useful to block unwanted traffic, but have them periodically audited to ensure their effectiveness.

It’s important to have all of these systems audited. Too often companies set up these systems and forget about them until something bad happens.
Regarding mobile security, executives traveling overseas should take a conventional cellphone. Another option would be to back up the data on your smartphone before the trip, use the phone overseas, and then wipe the entire phone before connecting to any of your home networks again.

Who can help put a solid cybersecurity plan in place?

There are professionals who have expertise specifically in cybersecurity. Companies in some cases are adding chief security officers to work alongside chief technology officers. However, if a company is not large enough to appoint someone to such a position, then the best option is to work with a consultant who is focused on the security side or a company that provides cybersecurity services on an ongoing basis.

900 million Android phones vulnerable to hacking from 'master key'

Researchers have uncovered a so-called master key for Google's Android operating system that could potentially render up to 99 percent of Android devices vulnerable—or worse, turn them into zombies.

 

Bluebox Security said its Bluebox Labs team found the vulnerability lets hackers modify APK code without breaking an app's cryptographic signature.

 

"The implications are huge! This vulnerability, around at least since the release of Android 1.6 (codename: Donut ), could affect any Android phone released in the last four years – or nearly 900 million devices," Bluebox chief technology officer Jeff Forristal said in a blog post.

 

"This vulnerability makes it possible to change an application’s code without affecting the cryptographic signature of the application – essentially allowing a malicious author to trick Android into believing the app is unchanged even if it has been," he added.

 

Also, depending on the type of application, a hacker can exploit the vulnerability for "anything from data theft to creation of a mobile botnet," Forristal said.

 

If exploited, the malicious parties can turn any legitimate app into a malicious Trojan, with the app store, phone or user none the wiser, Forristal warned.

 

Even worse, Forristal said the risk could be compounded by apps made by manufacturers or third parties that work in cooperation with the device manufacturer that get special elevated privileges within Android.

 

Forristal said a Trojan app from the device manufacturer can grant the app full access to Android system and all installed apps plus their data.

 

"The application then not only has the ability to read arbitrary application data on the device (email, SMS messages, documents, etc.), retrieve all stored account and service passwords, it can essentially take over the normal functioning of the phone and control any function thereof (make arbitrary phone calls, send arbitrary SMS messages, turn on the camera, and record calls)," he said.

 

Zombies

 

Most unsettling, Forristal said, is the potential for a hacker to take advantage of the devices being turned into botnets.

 

As botnets, they can be hard to detect because of the device's "always-on, always-connected, and always-moving (therefore hard-to-detect) nature."

 

Cryptographic signatures

 

Forristal said the vulnerability involves flaws in how Android apps are cryptographically verified and installed.

 

This allows the modification of APK code without breaking the cryptographic signature, he said.

 

Forristal said Bluebox has disclosed details of Android security bug 8219321 in February 2013.

 

"It’s up to device manufacturers to produce and release firmware updates for mobile devices (and furthermore for users to install these updates). The availability of these updates will widely vary depending upon the manufacturer and model in question," he said.

 

Recommendations

 

In the meantime, Forristal advised device owners to be "extra cautious in identifying the publisher of the app they want to download."

 

Also, he advised enterprises with BYOD (Bring Your Own Device) implementations to prompt all users to update their devices, and to highlight the importance of keeping their devices updated.

 

He also urged IT departments to "move beyond just device management to focus on deep device integrity checking and securing corporate data."

 

Google Play

 

On the other hand, tech site The Next Web said apps on the Google Play store are immune from such tampering, and a hacker would need to lure a user into downloading a malicious version of an app in other ways.

 

This may include a third-party app store or fake app links.

 

"A phishing email with a link to a fake update for a popular app, for example, might generate some downloads," it said.

 

"This is yet another reason to stick to official apps stores for downloads, although some Android owners — particularly those in China, where the Google Play store is skeletal — do frequent third-party app stores, while the fragmentation of Android is a reason others download apps from the Web," it added. — TJD, GMA News

CyberCoders: Continued Dramatic Increase for Cybersecurity Jobs in 2014

CyberCoders, a leading worldwide recruiting firm, today released new data forecasting a dramatic increase in the demand for cybersecurity positions. CyberCoders analyzed more than 450,000 job postings from 2009 to 2013 to evaluate hiring trends in the cybersecurity industry. CyberCoders reveals a more than 100 percent increase in open jobs in cybersecurity in the last year and forecasts continued increase of nearly 30 percent in 2014. Research includes those working as Chief Information Security Officers, Security Analysts, Security Architects, Security Engineers, Security Software Developers to name a few.

As the premier technical recruiting firm, CyberCoders serves more than ten thousand technology companies for their staffing and recruiting needs. CyberCoders newly released data confirms the growing public concern for protecting personal data and preventing cyber attacks on private networks.

"The market demand for positions in cybersecurity continues to boom," says Heidi Golledge, CEO and founder of CyberCoders. "Candidates with a cybersecurity background can expect to make $80,000 to $180,000 per year as they help either companies or the government protect their networks and data. CyberCoders has seen a rapid increase each year in the number of open jobs in this category and we expect the same growth for the foreseeable future as cybersecurity extends far beyond the government sector into nearly every company that has an Internet presence and data to protect."
Below is an overview of year over year growth in cybersecurity positions.
CyberCoders Hiring Trends: Cybersecurity Positions

Job Title                          Average Salary  Date       Increase %
   
Chief Information Security Offer      $161,617    2011-2012      96% 
   
Penetration Tester                     $81,500    2011-2012     119% 
 
Security Administrator                $101,518    2011-2012      99% 

Security Analyst                      $103,273    2011-2012      92% 
 
Security Architect                    $122,597    2011-2012      73% 

Security Consultant                   $112,935    2011-2012      53% 

Security Engineer                     $117,766    2011-2012      88% 

Security Software Developer           $101,127    2011-2012      39% 

 
 

"We expect to see even more growth than what we are on track for in 2013, based on our data we predict a 30 percent increase by 2014," says Matt Miller, Chief Technology Officer for CyberCoders.
In addition, CyberCoders forecasts an increase in the amount of money companies are willing to invest in cybersecurity. "Companies are putting more emphasis on executive level positions in cybersecurity. CEO's are beginning to understand the true value these positions have in an organization," says Miller. For example, a Chief Information Security Officer on average makes more than $160,000 dollars a year, and often leads a team of people whose sole purpose is to protect data and company networks.

"We speak a lot about hiring those who specialize in big data, but the need for people in these highly specialized security positions is just as great, more than ever companies are investing to keep vital information secure, a trend we will not see decreasing anytime soon," says Golledge.
For more information visit www.cybercoders.com
About CyberCoders

Founded in 1999, CyberCoders recruits professionals for all types of jobs including engineering, technology, sales, executive, financial, accounting, and scientific, legal and operational positions across all industries. With a team of more than 200 recruiters and thousands of job openings, CyberCoders is the worldwide leader in recruiting and staffing. CyberCoders continues to partner with some of the leading Fortune 500 companies around the nation and has been recognized as one of the top 100 companies on the Inc. 5000 list.

For more information on CyberCoders visit: www.CyberCoders.com

Cyber security: Why it needs to be a board-level issue and not just left to the IT department

A large multi-national, multi-disciplinary company with ambitions to break into the FTSE 100 top companies is holding its annual conference at a local country club. The CEO and finance director have just driven down from the delivering the company's annual results.

It has been a great year and the air is full of self-congratulations. The CEO stands up to give his keynote address; however despite the good share-price news and profit margins, his expectant audience is surprised to find his demeanour is unusually serious.

He explains that moving the company into the top FTSE will expose it to greater world-wide scrutiny from a range of industry competitors and those interested in the work it does on behalf of government departments. Indeed, he then reports that he thinks it is already happening, as the company had recently ‘lost' some of its critical intellectual property and missed out on a few large contracts.
The reason: poor cyber security that is the now the company's top priority. All eyes turned to look at the CIO who had gone as scarlet as a guard's uniform and was visible squirming in his seat! Were they right to single him out?

Actually they weren't! When the facts were looked at the incidents comprised the following: a mis-sent email (a strategy document sent to a competitor); commercial papers lost on a train; a former employee who was not legally prevented from taking bid information to a competitor; a laptop left on a plane with passwords attached; and careless use of social media giving away IPR.

In this particular case all breaches were down to human errors, none of them a direct fault of the ICT department or indeed any single department, but reflected a collective failure of the company to invest in its people. There was a distinct lack of collective education, training and a focus on critical information to support the company's business objectives, as well as suitable ICT products to use, business processes and fostering the correct pervasive culture of information risk management.
Does this sound like an IT department issue to you? No, and this particular case isn't unusual. Indeed, it was seen that human errors (and systems glitches) caused nearly two-thirds of data breaches globally in 2012, all of which could have been prevented with a holistic approach to cyber security within the organisation.

Of course, any of the most successful companies are organised along separate lines of business, each of which are often quite independent, with a light corporate centre managing a small number of corporate functions. The problem with cyber security is it's only as effective as its weakest leak. Therefore to ensure cyber resilience the whole company must be marching to the same beat; played to the same standard from the board to the factory floor.

Good cyber security comes from a holistic strategy set by the board and it's a matter of leadership and proactive information governance. All elements of a company must know ‘who, what, why and when' they are to share company information with. This needs a shared corporate understanding as to the threat and risks to different types of information and shared processes for safely handling them while exploiting the information to get as much ‘bang-for-the-buck' from it as they can.

All this will take top-down leadership and board-level commitment if it's to pervade throughout an organisation. It is no good if board members are recklessly using social media, emailing sensitive work to their home accounts, viewing board's papers on the latest insecure ICT, just so as to look good at the next conference they turn up at.

This poor leadership will not inspire cultural change, no matter how hard internal communications try to advertise best practice.

Andrew Fitzmaurice is CEO of Templar Executives