Log inRegister

Fraud News

Governance , IT Risk Management , Legacy Infrastructure Security

Fix WhatsApp, Windows, Cisco and CPUs From Intel - Pending Patch Availability(euroinfosec) • May 20, 2019    Cybersecurity's Week From Hell

Two years after WannaCry ransomware was unleashed, the cybersecurity realm isn't any calmer. Thankfully, there hasn't been another global ransomware outbreak threatening hospitals, businesses and consumers spreading rapidly around the world that has reached WannaCry's scale.

See Also: Webinar | Passwords: Here Today, Gone Tomorrow? Be Careful What You Wish For.

But last week, multiple flaws - all serious, all exploitable and some already being actively exploited in the wild - have come to light. Big names - including Cisco, Facebook, Intel and Microsoft - build the software and hardware at risk. And fixes for some of the flaws are not yet available.

Is this cybersecurity's new normal - prepare to be surprised, more frequently, and likely perhaps also more alarmingly, and with less time to respond?

Here's a recap of a cybersecurity week from hell.

Facebook Fixes WhatsApp

A buffer overflow flaw in WhatsApp has been used to target individuals and apparently to install Pegasys spyware, built by Israel's NSO Group and sold to governments and law enforcement agencies.

Exploiting the flaw does appear to have at least allowed attackers to eavesdrop on individuals' devices. Pegasus appears to have been sold to at least some governments with not-good human rights records, including Saudi Arabia (see: WhatsApp Exploit Reveals 'Legalized Hacking' at Work).

Alan Woodward, a professor of computer science at the University of Surrey, says everyone who uses WhatsApp should update it immediately or else uninstall it. But it's not clear if exploiting the flaw allowed attackers to auto-install spyware on Android or iOS WhatsApp users' devices. If so, the update will not remove that spyware.


Alan Woodward, a professor of computer science at the University of Surrey, analyzes the buffer overflow flaw that has been exploited in WhatsApp.

An app update that includes the security fix was released for Android on May 10, while the iOS version arrived three days later, on Monday. But many WhatsApp users may not know that they need to update the app themselves.

As of Thursday - six days after the Android version appeared, and three days after the iOS version was released - many users still hadn't updated, according to data gathered by mobile security vendor Wandera:

Who's Updated WhatsApp?

iOS WhatsApp users:

20 percent upgraded to patched version80 percent are still vulnerable

Android WhatsApp users:

45 percent upgraded to patched version55 percent are still vulnerable

Intel Battles ZombieLoad

Side-channel speculative execution flaws continue to be discovered in CPUs. Last week, a team of researchers as well as Intel confirmed that they'd found more flaws in processors along the lines of the Spectre and Meltdown flaws that came to light in early 2018. Dubbed ZombieLoad, the vulnerabilities would allow an attacker to retrieve private data from a processor's buffers.

Thankfully, no in-the-wild exploits have been seen against these flaws.

Intel has rolled out some microcode updates and others are on the way. Already, updates designed to help mitigate the problem have been shipped by operating system developers - including Apple, Microsoft, Red Hat and VMware - and will need to be installed. Cloud services firms such as Amazon and Google says they already have fixes in place.

Intel says future processors will have defenses to help prevent these vulnerabilities from being exploited. But many if not all processors built from 2011 onward will need fixes, which Intel says can degrade performance. Until fixes are available, experts recommend deactivating hyperthreading, which speeds up chip performance (see: Intel's 'ZombieLoad' Fixes May Slow Processors by 9 Percent).

Microsoft Updates Remote Desktop Services

To block another WannaCry-type worm, Microsoft is urging many users to update Remote Desktop Services - formerly known as Terminal Services - to fix CVE-2019-0708 (see: To Prevent Another WannaCry, Microsoft Patches Old OSs).

"This vulnerability is pre-authentication and requires no user interaction. In other words, the vulnerability is 'wormable,' meaning that any future malware that exploits this vulnerability could propagate from vulnerable computer to vulnerable computer in a similar way as the WannaCry malware spread across the globe in 2017," Microsoft warns. "While we have observed no exploitation of this vulnerability, it is highly likely that malicious actors will write an exploit for this vulnerability and incorporate it into their malware."

The good news is that Windows 8 and 10 do not have the problem

The not-so-good news is that vulnerable systems include Windows 7, Windows Server 2008 R2 and Windows Server 2008, as well as Windows 2003 and Windows XP, both of which are no longer supported, although Microsoft has released patches for them anyway. According to market researcher NetMarketShare, 4 percent of all PCs in the world that connect to the internet are still running Windows XP.

Thrangrycat Bites Cisco

Research published last week shows that secure boot functionality built into many Cisco devices isn't secure (see: Cisco's 'Thrangrycat' Router Flaw Tough to Neuter).

Cisco uses a field programmable gate array - or FPGA - as part of its "secure boot" process. But researchers from Red Balloon Security last week reported that Cisco hardware doesn't properly check to ensure that any firmware is legitimate before it allows it to run. As a result, an attacker with root access to the device could rewrite the firmware, and users would probably never even know it.

imageRed Balloon Security researchers demonstrated their exploit using Cisco's 1001-X enterprise router, but many other devices also have the flaw.

"We are unaware of any use of this exploit in the wild, but the potential danger is severe," say the Red Balloon Security researchers, who have nicknamed the vulnerability Thrangrycat.

Because the problem exists in hardware, it appears to be tough to fix. While Cisco has pushed updates for some devices, there's a longer list of vulnerable products for which no fixes are available, and there are no workarounds that can be used in the interim.

Fresh Hope

Last week wasn't all security dystopia. For example, the U.S. Justice Department and Europol announced that an international operation has disrupted the GozNym malware attack network, tied to $100 million in losses from more than 41,000 victims around the world. Six suspects have been arrested across the countries of Bulgaria, Georgia, Moldova and Ukraine and face local prosecution. Five remain at large and are believed to be in Russia (see: FBI and Europol Disrupt GozNym Malware Attack Network).

While that case is notable, GozNym has been operating since at least 2016, showing the lead time often required to bust cybercrime suspects. In addition, many criminals operating online remain at large. Washington public policy think tank Third Way, for example, earlier this year reported that "less than 1 percent of malicious cyber incidents ever see an arrest of the criminal."

In other words, law enforcement isn't going to save you; save yourself.

But Wait; There's More

But where to start? What's notable about the above flaws is that they're just the especially high-priority ones.

Microsoft's patch came as part of its monthly release of fixes, of which there are many more. And other vendors, including Adobe, have continued to ship their regularly scheduled batch of monthly patches too.

Another problem is that while security experts have for years been warning businesses and consumers to prioritize patches and then install them as quickly as possible, patches may arrive in deluges, and some of the flaws that have come to light in the last week cannot even be fixed. At best, they can be mitigated. But in the case of the Cisco vulnerabilities, some updates aren't available and any suitable workarounds have yet to be identified.

Hence organizations will have to patch. But in the meantime, in some cases they're still waiting for patch release dates, and thus having to track when they might be able to start testing and then planning to roll out future fixes.

Now, who knows what the coming days will bring?

Business Continuity Management / Disaster Recovery , Fraud Management & Cybercrime , Governance

President of Healthcare Organization Describes the Aftermath and the Lessons Learned(HealthInfoSec) • May 15, 2019    A Ransomware Victim Shares His Story

More and more healthcare organizations are getting targeted with ransomware attacks. What's it like to deal with the consequences?

See Also: 10 Incredible Ways You Can Be Hacked Through Email & How To Stop The Bad Guys

Jack Malone, president and executive director of the Southeastern Council on Alcoholism and Drug Dependence, Inc., shared with me some insights on the many headaches involved in the aftermath of such an incident - and important lessons to learn.

"We had security in place, but the door got slightly open for a tiny period of time, and these attackers found a way in. They're always looking for a way in." 

The attack against the Lebanon, Connecticut-based not-for-profit provider of inpatient, outpatient and residential treatment for substance abuse disrupted operations for only a few days. But it led to weeks of challenges, including difficulties in notifying former patients whose information may have been exposed.

SCADD discovered on Feb. 18 that it was a victim of ransomware. Malone suspects the attackers got into the organization's network right before that when SCADD "opened a portal to a server" to allow federal auditors to conduct a required financial audit. "That audit took two days, and the attacker probably snuck in then," he says.

SCADD hired a third-party firm to help it recover from the ransomware attack without paying the $1,800 ransom demanded by the extortionists to provide a decryption key. "They didn't ask for $10 million. The [attackers] were probably trying to cash in wherever someone is willing to pay a smaller amount," he says.

The recovery effort for dealing with what Malone describes as "run of the mill" ransomware took about a week using back-ups, he says. During that time, certain clinical functions couldn't take place, despite the entity's current cloud-based electronic health record system not being impacted by the attack, he says.

The bulk of patient records potentially compromised in the attack were part of about seven years' worth of information that SCADD has to hold onto for regulatory purposes, he says. That includes digitized patient records created before the entity's move to a cloud-based EHR last year.

SCADD is notifying an estimated 25,000 individuals whose information, including name, address and Social Security number - as well as medical history and treatment information - was potentially exposed to the attackers.

"Many of these people are indigents - 95 percent of them are the sickest and the poorest people in eastern Connecticut," Malone says. Reaching many of these individuals is difficult, he explains, because their only known address might be the last substance treatment facility - such as a half-way house - where they stayed, perhaps years ago.

"Their Social Security numbers are not valuable," Malone says, speculating that if fraudsters attempted to use them to, for example, create an identity to use to open a credit account, they'd likely be turned down due to poor credit history.

Costly Attack

Still, government regulations require that SCADD make the effort to notify each impacted individual.

"That's 55 cents a pop [for postage of each letter], and a high percentage of these people will never receive the letter," he says. A law firm SCADD hired advised Malone that its news release about the ransomware attack should legally suffice for those individuals SCADD can't directly reach.

Thankfully, SCADD has cyber insurance, which will cover the costs associated with the attack, Malone says. Those expenses could run as high as $100,000, he estimates. "That's a door-closing event," he says of the cost - if the organization had to pay it on its own. "We're a small, community-based non-profit," he notes.

In addition to confirming the value of cyber insurance, what's the other big lesson learned from this attack?

"Lock your 'doors.' We had security in place, but the door got slightly open for a tiny period of time, and these attackers found a way in. They're always looking for a way in," he says.

Persistent Threat

The recently issued 2019 Verizon Breach Investigations Report says that for the second straight year, ransomware attacks accounted for over 70 percent of all malware incidents in the healthcare sector.

Malone's tale of the headaches and expenses that come after a ransomware attack offers an important reminder that healthcare organizations should investigate cyber insurance, have a breach notification plan in place and make continual efforts to keep the bad guys out.

Breach Preparedness , Cybercrime , Cybersecurity

Post-Snowden Transparency, Incident Response Push by Western Allies Continue(euroinfosec) • May 6, 2019    Cybersecurity Drives Intelligence Agencies in From the ColdGCHQ Director Jeremy Fleming addresses the CyberUK conference on April 24. (Photo: NCSC)

Intelligence agencies and cybersecurity: What a long, strange trip it's been.

See Also: Webinar | Passwords: Here Today, Gone Tomorrow? Be Careful What You Wish For.

Flash back to 2000, when Richard C. Schaeffer, then the U.S. Defense Department's director of information assurance, showed up to Def Con to pitch the hacking community on government employment.

"The CIA is caucusing in the men's room." 

"We've got some of the most sophisticated toys in the world if you'd like access to those toys," he told the Las Vegas audience.

Attending that Def Con as a reporter, I saw evidence of intelligence agency representatives interfacing with the information security community - not just when outed during the annual "spot the fed" challenge - as a colleague of mine captured at the time. We were waiting for a press conference to commence in the media room, which was being held on condition that we all removed the batteries from our cell phones. "We apologize for the delay," a Def Con press attaché told us, killing time. "The CIA is caucusing in the men's room."

Not so many months before Schaeffer's public appearance, the Echelon surveillance system first developed during the Cold War came to light, sparking furious public debate. Built as a Cold War tool by "Five Eyes" - the intelligence alliance formed in 1941 between Australia, Canada, New Zealand, the U.K. and the U.S. - Echelon had been updated to monitor modern communications. In 2015, Edward Snowden's leaks confirmed even more details about Echelon.

Intelligence Agencies Offer Help

In the wake of Snowden's leaks, there's been an unprecedented push by Western intelligence agencies to come in from the cold, at least where cybersecurity is concerned.

The intention appears largely aimed at helping organizations to better protect themselves.

At the 2018 RSA Conference in San Francisco, for example, David Hogue, the technical director of the National Security Agency's Cybersecurity Threat Operations Center - the security operations center in charge of defending unclassified DOD networks - delivered a session focused on the latest attacks CTOC had been seeing. Notably, Hogue said attackers weren't bothering to waste zero-day exploits; he hadn't seen one inbound in two years (see: NSA: The Silence of the Zero Days).

Free Tools

At the 2019 RSA Conference in March, Rob Joyce, cybersecurity adviser to the director of the NSA, delivered a presentation titled "Get Your Free NSA Reverse Engineering Tool." In an update on Schaeffer's message from 19 years ago, Joyce said part of the impetus for releasing the tool, called Ghidra, was to help educate more students and give the agency access to a bigger pool of potential recruits (see: NSA Pitches Free Reverse-Engineering Tool Called Ghidra).

Joyce appeared on stage again in April at CyberUK, an annual conference held by the U.K.'s National Cyber Security Center, which is the public-facing arm of intelligence agency GCHQ. NCSC was created to help British organizations conduct incident management in the wake of breaches as well as to improve the public's cybersecurity posture.

"We were set up to be technically expert," helping British organizations handle cyberattacks, cyber threats and incident management, Ciaran Martin, chief executive of the NCSC, told reporters at this year's CyberUK in Glasgow, Scotland.

imageCiaran Martin at CyberUK 2019

Over the two-day conference, Martin fielded numerous questions on topics ranging from the health of the Five Eyes alliance in the wake of ongoing debate over Huawei, to British approaches to combating election interference and the "big four" nation-state attackers - China, Russia, Iran and North Korea.

British businesses don't appear to have hesitated to work with the NCSC, despite it being part of an intelligence agency. Paul Chichester, the NCSC's operations director, told me during a CyberUK press conference that the EU's General Data Protection Regulation bringing to light European data breaches for the first time has really driven uptake.

"I don't think it's dramatically changed the number or volume of breaches that we've been seeing," he told me. "What has massively changed is awareness. People are much more interested in preparing for breaches, and we have seen people preparing for what they want to do after a breach."

Canada Launches Cyber Security Center

It's not clear if such an approach would work in the U.S., given concerns over intelligence agencies monitoring private communications.

But some other countries are following suit, including Canada, which last year launched its own Center for Cyber Security.

"We saw the U.K. take. With the standup of the Canadian Center for Cyber Security, we're doing the same thing, speaking publicly, with a public face," Scott Jones, the center's director, told me in a one-on-one interview. "So for the first time, our senior officials are on our website, explaining what they do and what their roles are."

Jones told me that businesses are eager for help. "The response has been overwhelming - very supportive from industry and Canadian companies wanting to work with us. Both the smaller organizations that are wanting to work with us to solve certain cybersecurity challenges, up to the largest companies in Canada wanting to work with us to solve critical infrastructure challenges" - and more, he said.

Senior Officials Appear in Public

CyberUK was previously closed to the news media, except for last year's keynote, for which journalists were escorted in and then out. But this year, I was one of a group of journalists cleared to attend the full CyberUK, except for a handful of restricted sessions.

The conference offered numerous highlights. For the first time on British soil, representatives from each of the Five Eyes appeared together in public - on a panel at CyberUK - to discuss their efforts to better safeguard their respective nations (see: Intelligence Agencies Seek Fast Cyber Threat Dissemination).

imageScott Jones, head of the Canadian Center for Cyber Security, speaking on a CyberUK panel next to intelligence officials from Australia, New Zealand, the U.K. and U.S., all seated alphabetically by country.

GCHQ Director Jeremy Fleming, in a rare public appearance, delivered the conference's opening keynote speech. Fleming highlighted some of the many changes that have occurred since the U.K. created its first cybersecurity strategy in 2009, followed by launching a five-year National Cyber Security Strategy in 2015 - set to be renewed next year - that included launching the NCSC to be the public-facing, one-stop government shop for all things cyber.

"Since its formation, the NCSC has coordinated responses to some of the biggest cyber threats the country has faced. Our incident management team has worked on more than 1,500 significant cyber security incidents," he said. "And using automation, it has reduced the harm from thousands of attacks a month. And it has played a major role in dealing with the strategic threats we face from hostile states."

Forecast: More of Everything

Fleming predicted and promised more of everything. "We suffer attacks every day - and while we have not faced a Category 1 attack [the most damaging type of attack], we must continue to plan for when it happens," he said.

In addition, he said the 2020s will "bring an opportunity to fix our critical national infrastructure," in no small part by baking in "cybersecurity as new systems are brought in to replace aging legacy systems," and that "once again, security by design must be our aim."

Of course, there are limits to what intelligence agencies can - and should - do. "Contrary to popular belief, we're not omnipotent, we don't know every threat actor out there," NCSC's Chichester told reporters.

imagePaul Chichester, NCSC's director of operations, at CyberUK 2019

But with data breach notifications continuing to come fast and furious and organizations so often getting hacked and not knowing it, what NCSC and its ilk do know about is defense, detection, threat intelligence and response. And organizations today need their help with each of those more than ever.

People accessing the internet at McDonald’s and Westfield in Australia could be targeted for surveillance by police under new encryption legislation, according to the home affairs department.

A briefing by the department, obtained under freedom of information, reveals that police can use new powers to compel a broad range of companies including social media giants, device manufacturers, telcos, retailers and providers of free wifi to provide information on users.

The Telecommunications Access and Assistance Act, which passed parliament in December, prompted warnings of legislative overreach, particularly due to the large number of offences with a prison sentence of three years, which bring suspects within reach of the new powers.

Despite warnings from the tech sector it would harm Australian companies and a promise from Labor to amend the law, the re-election of the Morrison government means it will continue in its current form – at least for this term of parliament.

The departmental briefing gives examples of potential targets for technical assistance and technical capability notices, which give law enforcement agencies the power to compel cooperation from “designated communications providers”.

Social media companies including Facebook, search engine Google, equipment providers including the Apple store, cloud computing providers, providers of free wifi including McDonald’s and Westfield, and “any Australian retailer who offers a mobile phone application for online shopping or offers an application for mobile viewing” are named as potential targets.

The Communications Alliance chief executive, John Stanton, said it was “no surprise” to see the “enormously broad range of players” that are classified as communications providers.

“It’s been a concern from day one,” he said. “The only thing consumers will know is if there is a weakness introduced into the system, their provider won’t be able to tell them about it. It’s not something that would readily engender trust.”

Stanton noted the legislation extended to “companies outside Australia”, such as component providers, which would not be familiar with the regime.

The briefing also provides examples of what type of assistance authorities can lawfully require, including: a social media company helping to automate the creation of fake accounts; a mobile carrier increasing the data allowance on a device so surveillance doesn’t chew up users’ data; blocking internet messages to force a device to send messages as unencrypted SMSes; and a data centre providing access to a customer’s computer rack to allow installation of a surveillance device.

Stanton said “one of the more concerning examples is the installation of software on to a network that’s been developed by agencies”.

“The service provider isn’t necessarily going to know what that software is capable of doing, and what risks it presents to the security of its network and its customers.”

The legislation prohibits agencies from requiring a “systemic weakness” be built into products. Stanton noted that although this precludes a weakness in every phone of a particular model, the law suggests if agencies “require installation on every iPhone in NSW – that wouldn’t be a backdoor. But by any sensible construction it would be.”

The briefing states that notices are “not intended to be issued to persons within an organisation” but rather the entity as a whole, attempting to address tech industry fears that individual employees could be forced to assist without informing their employers.

Asio has said it needs the new powers because encryption technology is affecting 90% of its priority cases, harming the spy agency’s capability. The briefing warns that by 2020 most communications will be end-to-end encrypted.

Police are already using powers in the encryption legislation, although the first reported uses have been the threat of higher penalties to coerce criminal suspects to unlock digital devices such as phones.

About 885 million documents, including bank account numbers, mortgage records, Social Security numbers, drivers’ license images and tax records, have been leaked by First American Financial Corp.’s website.’

Anyone with a web browser and a URL for a legitimate document could access the real estate title company’s records, according to a report by KrebsOnSecurity, which noted many of the documents related to wire transactions involving property buyers and sellers.

“At first glance it appears that this vulnerability is an insecure direct object reference (IDOR) because the developer who found the vulnerability stated that he was retrieving different documents by simply changing the document number,” said Jon Bottarini, hacker and lead federal technical programs manager at HackerOne. “Modifying the document number in his link by numbers in either direction yielded other peoples’ records before or after the same date and time.”

The impact of the exposure is unknown. “It should be noted that while the vulnerability in the system has been confirmed, it’s unclear that it was exploited by malicious individuals. In that respect, it is difficult to assess the full impact at this moment,” said Hardik Modi, senior director of threat intelligence at NetScout. “I would expect that an investigation of logs should reveal whether there was actual malicious access of records at any scale.”

But Bottarini noted “that since a large majority of lenders use First American, it is highly possible that some of the recent scams regarding escrow fraud could be related to this breach in particular.”  

Successful escrow fraud plays on both “naivité and speed as it relies on fake email accounts to execute the scam,” he said. “If a scammer had access and decided to exploit this vulnerability in particular, it would save a ton of time and effort and make this scam very easy to pull off because they would have all the Personal Identifiable Information (PII) necessary without having to hack into each individual title company.” Arrmed with that information, the fraudster can easily “spoof the title company’s site and send instructions to the end user to wire money needed to close on a property, usually to the fraudster’s account.”

The First American incident is just the latest in a string of examples of how many of the legacy systems that underlie our society are inherently flawed,” said Ernesto DiGiambattista, founder and CEO, ZeroNorth. “We know the company exposed hundreds of millions of records that date back 16 years, but we don’t yet know how long they had been exposed.”

Since threat actors “continue to exploit vulnerabilities that may have existed for months or years, and as business and economies are increasingly driven by technology,” DiGiambattista said, “the threat of legacy systems becomes more severe.”

Authentication , ID & Access Management , Multi-factor & Risk-based Authentication

Cause for Celebration: Microsoft Stops Recommending Periodic Password Changes(euroinfosec) • May 2, 2019    Party Like Every Day Is World Password Day

Hallmark alert: Hands up if you hate "days" devoted to this or that.

See Also: Webinar | The Future of Adaptive Authentication in Financial Services

Besides celebrating Mom, Dad and Star Wars, I'd argue we don't need any more days, thank you very much (see: 7 'Star Wars Day' Cybersecurity Lessons).

But with May 2 rolling around again, nonstop alerts that Thursday is World Password Day are tough to miss.

So here's a pro tip: For everyone who uses an online site or service, every day needs to be a password day. Attackers certainly aren't dormant the other 364 days of the year.

Unfortunately, every year, "correct horse battery staple" password guidance gets trotted out to annoy and confuse users, along the lines of choosing passwords with at least eight characters that include the name of your first llama, the first letters of a phrase you love, plus a few random numbers and symbols.

Password Security: A New Hope

For this year's password day, however, it's important to note that there have been a number of recent changes that make password security easier than ever. I don't mean primarily for users, although they're an important part of the equation.

Rather, Microsoft and others are finally getting their act together when it comes to not forcibly expiring passwords, letting users paste passwords as well as helping to ensure that users don't pick easily guessable - aka pwnable - passwords.

While the onus remains on businesses to better keep users' data - including passwords - secure and enforce minimum password security standards, let's first recap what end users can do to best help themselves. Then we'll move on to what businesses need to do.

So if you want to get all "Hallmark" about it, be sure to pass these tips along to your employees and customers.

First Essential: Keep It Unique

Above all else, the best way to protect your data and privacy - to the extent that you can - is to use a unique password for every site and service. Never, ever reuse a password. Also make sure it's not a commonly used password.

What do those look like? Together with Troy Hunt and his Pwned Password service, the U.K.'s National Cyber Security Center has released a list of the 100,000 most commonly used passwords seen in online breaches. Attackers often employ lists like these to try to brute-force their way into accounts, using email addresses they've obtained from other sources.

Reusing passwords means that if an attacker breaches a site and steals your username and password, they can use it in an attempt to log onto every other site or service you use.

image"This is the underlying problem, says Australian password security expert Troy Hunt about credential stuffing. "People have said: 'Hey, I have a favorite password, it's my cat's name and this is the year that it was born; this is fantastic and I'm going to use it everywhere.'"

Such credential stuffing is rife, given its apparent ease and efficacy (see: Credential Stuffing Attacks: How to Combat Reused Passwords).

Second Essential: Use a Password Manager

The best way to be unique is to outsource the job to a password manager.

Sorry, but when it comes to picking a password, extensive research has found that our choices aren't unique enough to block brute-force attacks.

Enter password managers, which not only generate unique passwords, but also store them and quickly retrieve - and allow users to paste them - for every different site or service they use. My password manager has hundreds of entries, from Amazon, eBay and the Guardian to work accounts, pet microchip codes and bicycle padlock combinations.

Password management software runs on PCs and smartphones, meaning you can always carry your passwords with you, securely stored. In some cases, keeping passwords in a book at home - preferably stored in a safe - might also be an option. But it's tough to beat the software.

Third Essential: Activate Second Factors

As Martijn Grooten, editor of Virus Bulletin, has noted, always use a second factor to secure your important accounts.

Numerous sites now offer two-step authentication. Many banks provide one-time passwords via SMS (not great) or authentication apps on smartphones (much better).

Fourth Essential: Businesses Must Do Better

Picking unique passwords remains something that users can do.

But so much of the password security equation relies on businesses handling passwords correctly, avoiding coding errors, offering strong second authentication capabilities and forcing users to reset their passwords if any of this is in doubt, especially after a breach (see: LinkedIn's Password Fail).

Most service providers store passwords as hashes, which are mathematical representations of a plain-text password. Hashes are supposed to be irreversible, meaning that it's not possible to start with a hash and figure out of the real password. Even better is when sites also "salt" the password by adding random data to it before hashing.

Banish MD5 and SHA1

In years past, however, many businesses used hashing algorithms such as MD5 and SHA1, which weren't fit for their purpose, because they're easy to crack and also failed to salt (see: We're So Stupid About Passwords: Ashley Madison Edition).

Thankfully, many have adopted password-hashing algorithms such as bcrypt, which are much more resistant to hash-cracking hardware.

Blacklist Common Passwords

The Pwned Password list gathered by Troy Hunt and published by NCSC gives organizations a way to easily improve the security of any passwords their service users might choose (see: Here Are 306 Million Passwords You Should Never Use).

imagePwned Passwords: Top 20

The U.S. National Institute of Standards and Technology, for one, recommends blocking passwords that have previously appeared in breaches, or which might have repetitive or sequential characters or context-specific words.

imageExcerpt from NIST's authentication & lifecycle management document, including Credential Service Provider (CSP) guidance. (Source: Troy Hunt)

Unleash the Power of Pasting

Security experts say sites should never block users' ability to paste usernames and passwords when authenticating. That's because password managers give users this capability, which then speeds up the process of allowing users to both store and use unique passwords.

"Let them paste passwords," the NCSC's "Sacha B." writes in a blog post.

Stop Expiring Passwords

Numerous security experts, including NCSC - part of Britain's GCHQ intelligence agency - also recommend not forcing regular passwords to expire. "It's one of those counterintuitive security scenarios; the more often users are forced to change passwords, the greater the overall vulnerability to attack," NCSC reports.

That's because when users are forced to keep changing passwords, they too often default to something easy to remember, which is typically easy to crack. We humans aren't good at picking properly "unique" passwords (see: Successful Security? Stop Blaming Users).

One password-expiry holdout has been Microsoft, which continues to require that Office 365 passwords get changed every 90 days, and which has recommended that Windows administrators enforce the same.

Microsoft Wakes Up

Finally, however, a reason to celebrate on the occasion of the latest World Password Day: The latest security baseline draft from Microsoft for Windows 10 and Windows Server recommends "dropping the password-expiration policies that require periodic password changes."

Here's why: "Periodic password expiration is an ancient and obsolete mitigation of very low value, and we don't believe it's worthwhile for our baseline to enforce any specific value," Microsoft says.

"By removing it from our baseline rather than recommending a particular value or no expiration, organizations can choose whatever best suits their perceived needs without contradicting our guidance," it adds. "At the same time, we must reiterate that we strongly recommend additional protections even though they cannot be expressed in our baselines."

Office 365 Default: Passwords Don't Expire

Microsoft's latest Office 365 guidance now says the same thing. "By default, passwords are set to never expire," Microsoft tells administrators. "Current research strongly indicates that mandated password changes do more harm than good. They drive users to choose weaker passwords, reuse passwords, or update old passwords in ways that are easily guessed by hackers."

So for any Windows or Office 365 users who remain forced to reset their passwords every 60 days - or whenever - forward Microsoft's policy to your administrator and tell them it's time to reset their approach.

pictures and phone Image copyright Getty Images

The US Navy is seeking to create an archive of at least 350 billion social media posts from around the world, in order to study how people talk online.

The military project team has not specified which social media platform it intends to collect the data from.

The posts must be publicly available, come from at least 100 different countries and include at least 60 different languages.

They should also date between 2014 and 2016.

The details were revealed in a tender document from the Naval Postgraduate School for a firm to provide the data.

Applications have now closed.

Additional requirements included:

the posts must come from at least 200 million unique users no more than 30% can come from a particular country at least 50% must be in a language other than English location information must be included in at least 20% of the records

Private messaging and user information will not form part of the database.

"Social media data allows us for the first time, to measure how colloquial expressions and slang evolve over time, across a diverse array of human societies, so that we can begin to understand how and why communities come to be formed around certain forms of discourse rather than others," T Camber Warren, the project's lead researcher, told Bloomberg.

The US Navy was behind the creation of Tor, the anonymous browsing network, in 2002.

Tor, also known as The Onion Router, aims to conceal where people go online by using encryption and randomly bouncing requests for web pages through a network of different computers.

Flag of China

Computer plate and flag of China

Getty Images/iStockphoto

Amidst an escalating trade war and political tensions with the US, Beijing officials have decided to develop a custom operating system that will replace the Windows OS on computers used by the Chinese military.

The decision, while not made official through the government's normal press channels, was reported earlier this month by Canada-based military magazine Kanwa Asian Defence.

Per the magazine, Chinese military officials won't be jumping ship from Windows to Linux but will develop a custom OS.

Thanks to the Snowden, Shadow Brokers, and Vault7 leaks, Beijing officials are well aware of the US' hefty arsenal of hacking tools, available for anything from smart TVs to Linux servers, and from routers to common desktop operating systems, such as Windows and Mac.

Since these leaks have revealed that the US can hack into almost anything, the Chinese government's plan is to adopt a "security by obscurity" approach and run a custom operating system that will make it harder for foreign threat actors -- mainly the US -- to spy on Chinese military operations.

The task of developing the new OS and replacing Windows will fall to a new "Internet Security Information Leadership Group," as first reported by the Epoch Times, citing the May issue of the Kanwa Asian Defence magazine.

Per the magazine, this new group answers directly to the Central Committee of the Chinese Communist Party (CCP), being separate from the rest of the military and intelligence apparatus.

This is similar to how the United States Cyber Command operates as a separate entity in the US Department of Defense, separate and independent from the other US military and intelligence agencies.

In the late 90s, North Korea also developed a custom operating system for use inside the country, called Red Star OS. The OS is still alive, it is a Linux distro, but it never became the "only" official OS for government agencies, which continued to use Windows, Mac, and Linux in parallel.

Related government coverage:

  1. The Ethical Hackers Taking The Bugs To The Bank
  2. Amazon Defeated Rekognition Revolt By A Large Margin
  3. Snapchat Spied On Users With Internal Tool
  4. Intense Scanning Activity Detected For BlueKeep RDP Flaw

Page 250 of 354