Security

Link

Security Researchers are Fed Up With Apple's Bug Bounty Program

Andrew Orr ·

For five years Apple has invited ethical hackers to break into its products to look for flaws. But these security experts are tired of the program.

The best programs support open conversations between the hackers and the company. Apple, already known for being tight-lipped, limits communication and feedback on why it chooses to pay or not pay for a bug, according to security researchers who have submitted bugs to the bounty program and a former employee who spoke on the condition of anonymity because of a nondisclosure agreement.

Link

Microsoft President Brad Smith Says Government Agencies Need to Share Data

Andrew Orr ·

Microsoft President Brad Smith says intelligence agencies need to share information to better protect the nation against cyberattacks.

Repeatedly in late 2020 we found people in federal agencies asking us about information in other parts of the government, because it was easier to get it from us than directly from other federal employees. A culture of holding information tightly is so ingrained in the government that even its contracts with us forbid us from letting one part of the government know that another part has been attacked.

President Biden has taken a couple of steps so far.

Link

AdGuard: 'People Should be Worried About Apple CSAM Detection'

Andrew Orr ·

Adblocking company AdGuard is the latest to offer commentary on Apple’s controversial decision to detect CSAM in iCloud Photos. The team ponders ways to block it using their AdGuard DNS technology.

We consider preventing uploading the safety voucher to iCloud and blocking CSAM detection within AdGuard DNS. How can it be done? It depends on the way CSAM detection is implemented, and before we understand it in details, we can promise nothing particular.

Who knows what this base can turn into if Apple starts cooperating with some third parties? The base goes in, the voucher goes out. Each of the processes can be obstructed, but right now we are not ready to claim which solution is better and whether it can be easily incorporated into AdGuard DNS. Research and testing are required.

Link

Chinese Hackers May be Stealing Data to Feed an Artificial Intelligence

Andrew Orr ·

Dina Temple-Raston of NPR published a fascinating investigation regarding the Microsoft Exchange attack earlier in 2021.

Officials believe that the breach was in the service of something bigger: China’s artificial intelligence ambitions. The Beijing leadership aims to lead the world in a technology that allows computers to perform tasks that traditionally required human intelligence — such as finding patterns and recognizing speech or faces.

Link

US Air Force Contract Aims to Improve Blockchain Security

Andrew Orr ·

The United States Air Force will use Constellation’s Hypergraph Network to provide data security with the Department of Defense’s commercial partners.

Constellation said it had been working with Kinnami Software Corporation to develop an end-to-end data security solution using blockchain encryption and distributed data management for the United States Transportation Command, Air Mobility Command’s 618th Air Operations Center, and a Civil Reserve Air Fleet partner. According to the platform, its goal is to securely exchange data with commercial partners on missions involving the operations of aircraft and ships under contract to the Department of Defense, or DoD.

Link

Data Leak From Chinese Company 'EskyFun' Affects 1 Million Gamers

Andrew Orr ·

The research team at vpnMentor discovered an unsecured server from Chinese mobile gaming company EskyFun. It exposed data for over a million Android gamers.

The resulting records contained a lot of sensitive information, including: IP address, IMEI number, Mobile application package doing the tracking, Device screen size – whether a device is ‘rooted’*, Device model, Phone number (if any), Platform (Android/iOS), NetType (WiFi or cellular), Events (open,login,level_up, etc).

Not so fun anymore.

Link

Your Internet Activity May be Traceable Even Through a VPN

Andrew Orr ·

Netflow data refers to IP network traffic that can be collected as it enters or exits an interface. Using this aggregate data, it’s possible to trace network traffic even if a person uses a VPN. Internet service providers sell this information to third parties.

At a high level, netflow data creates a picture of traffic flow and volume across a network. It can show which server communicated with another, information that may ordinarily only be available to the server owner or the ISP carrying the traffic. Crucially, this data can be used for, among other things, tracking traffic through virtual private networks, which are used to mask where someone is connecting to a server from, and by extension, their approximate physical location.

Link

Social Engineering Majority of Business Attacks in 2020

Andrew Orr ·

Speaking of social engineering, new data from Atlas VPN shows this kind of attack was responsible for the majority of business breaches in 2020.

According to the data presented by the Atlas VPN team, social engineering cyberattacks were the primary cause of company breaches in 2020 at 14%, followed by advanced persistent threats, unpatched systems and ransomware. As a result, learning to prevent social engineering attacks needs to be a top priority for businesses.

Link

Misconfigured Microsoft Power Apps Leaked 38 Million Database Records

Andrew Orr ·

Over a thousand web apps from Microsoft’s Power Apps platform have leaked 38 million records. This data includes COVID-19 contact tracing.

The data included a range of sensitive information, from people’s phone numbers and home addresses to social security numbers and COVID-19 vaccination status.

The incident affected major companies and organizations, including American Airlines, Ford, the transportation and logistics company J.B. Hunt, the Maryland Department of Health, the New York City Municipal Transportation Authority, and New York City public schools.

Link

The Secret Security Features in macOS Big Sur

Andrew Orr ·

There are security features that Apple tells us about on stage at keynotes, and then there are hidden improvements it doesn’t mention.

macOS has gradually made the UNIX security model irrelevant. For example, even the superuser is only allowed to access the private documents of a regular user with the user’s permission—permission that is given on a per-application basis, through that protector of users and bane of developers known as the Transparency, Consent & Control (TCC) framework.

Link

Coinbase Announces Phone Support for Account Takeovers

Andrew Orr ·

On Thursday, crypto exchange Coinbase announced phone support in the event of an account takeover.

Today, we’re beginning to roll out phone support for ATOs, to provide customers with a live agent to kick off an investigation. If you believe you’re a victim of an ATO, please call +1 888 908–7930 or visit our support page to protect your account and get help.

Link

Since 2015 Cyber Attacks Have Cost Companies Over $25 Billion

Andrew Orr ·

A report on Wednesday shows that the damage from cyber attacks has reached over US$$25 billion since 2015.

The most costly attacks are credential attacks (the theft of an organization or individual’s passwords), which have accounted for $6.4 billion in company losses. Often, these credentials are stolen and then sold on the dark web, which happened in the recent T-Mobile breach. Backdoors, like what was used in the SolarWinds hack, have cost companies $5.6 billion.