Log inRegister

Fraud News

Data Breach , Data Loss , Fraud Management & Cybercrime

Committee Demands Answers About Consumers' Complaint Filed With FTC(HealthInfoSec) • February 20, 2019    Congress Scrutinizes Facebook Health Data Privacy ComplaintPhoto: Jimmy Baikovicius via Flickr/CC

In the latest privacy controversy involving Facebook, a Congressional committee is demanding the social media giant provide answers concerning a complaint filed with the Federal Trade Commission alleging misleading practices involving consumers' personal health information.

See Also: Sunset of Windows Server 2008: Migrate with Docker

That complaint also called attention to an incident when a security researcher was able to download the names and other personal information of over 10,000 cancer patients who were participating in a Facebook health group.

In a letter sent Tuesday to Facebook CEO Mark Zuckerberg, House Energy and Commerce Committee Chair Frank Pallone, D-N.J., and Consumer Protection and Commerce Subcommittee Chair Jan Schakowsky, D-Ill., demanded a staff meeting no later than March 1 to discuss with Facebook issues raised by the recent FTC complaint, "so we can better understand Facebook's practices with respect to so-called closed and anonymous groups."

"Despite the indications that the groups were private and anonymous, people and companies who should not have been admitted to these groups gained access to them and to lists of group members."
—Energy and Commerce Committee

The complaint at the center of the latest Congressional inquiry into Facebook was filed in December but made public this week. It alleges that Facebook has been misleading its users regarding the private or anonymous nature of "closed" Facebook groups.

The complaint, filed by security researcher Fred Trotter and members of a Facebook health group, alleges that the company misleads users about how their personal health data is being shared, used and curated in Facebook Groups and that Facebook's practices are unfair.

It also argues that the Facebook Groups platform "should be regulated as a personal health record" under FTC rules.

Series of Allegations

The complaint lists a series of allegations against Facebook concerning its privacy and business practices.

According to a timeline included in the complaint, a member of a Facebook health group in March 2018 discovered that she had the ability to download the membership list of "closed" or "public" Facebook groups using a Chrome web browser extension called grouply.io.

The Facebook member reached out to security researcher Fred Trotter to discuss her concerns. In April 2018, using grouply.io, Trotter downloaded the names for the entire membership list - which included over 10,000 names - of a Facebook group.

"All members of this group are positive for the BRCA cancer mutation," the complaint notes. "Most of the names on the downloaded list include email addresses, city of residences and employers of the women who participate in the Facebook closed group."

On May 29, 2018, in accordance with Facebook's responsible disclosure policy, Trotter and other patient community members submitted a report to Facebook about the vulnerability allowing the download of personal information from the Facebook site. They dubbed the vulnerability Strict Inclusion Closed Reverse Lookup Attack, or SicGRL, calling the problem, "a life-threatening vulnerability in the Facebook privacy architecture," the complaint notes.

Personal Health Record?

The report to Facebook claimed that Facebook's group product counted as a personal health record under FTC rules, "and explicitly reminded Facebook that the breach notification rules and deadlines apply," the FTC complaint notes.

By June 12, 2018, "the 10 business day deadline for reporting the PHR breach to the FTC passed," the complaint notes. On June 20, 2018, Facebook responded to the SicGRL report submission, indicating that its security team would not "commit to fixing the problem and did not acknowledge the issue as a privacy or security vulnerability."

No member of the redacted Facebook group received a notice that Trotter downloaded their real names and the fact that they are BRCA positive, the complaint to FTC states.

On June 29, 2018, members of the Facebook group discovered that Facebook group membership is no longer "world readable," the complaint notes. "This change means that although SicGRL is still a problem, it is no longer trivial to exploit at scale," according to the complaint.

Because the vulnerability could no longer easily lead to "a mass-casualty event," Trotter and a member began discussing the problem with the news media in late June 2018, the complaint notes. And then in July 2018, Facebook publicly denied that a privacy breach had occurred, the complaint adds.

In addition to the alleged breach, the complaint also claims that Facebook is not transparent about how users are targeted for advertising and for invitations to join certain medical support groups, and how their health data could be accessed by others once they join those groups.

A Significant Hurdle

Privacy attorney David Holtzman, vice president of compliance at security consultancy Cynergistek, says the complaint raises surprising allegations that Facebook is operating a PHR.

"From a consumer's perspective, is seemed like a good idea to have a portal that allows for entry of identifiable information to be shared with a select group of other consumers," he notes. What those consumers did not expect, however, was that Facebook would allow the data to be disclosed to third parties or assembled into a broader, expansive personal profile of the consumer, he adds.

"The consumers face a significant hurdle in making the connection that the Facebook Groups product meets the definition of a PHR," he argues. "If the FTC finds these products are a PHR, then it is more likely that Facebook had an obligation to assess if the data had been compromised, and to carry out breach notification [under FTC's Health Breach Notification Rule] if it knew or should have known a breach had occurred."

The separate HIPAA Breach Notification Rule would not apply to Facebook because it is not a covered entity or a business associate to a covered entity, he notes.

Unauthorized Disclosures

In the letter to Zuckerberg, the Congressional committee writes that the FTC complaint notes "that health information of certain Facebook users may have been exposed, leading to countless unauthorized disclosures of personal health information, harassment and a risk of discrimination."

According to the complaint filed with the FTC, "Facebook's algorithms used personal information it collected from Facebook users to suggest and even solicit members of online support groups for a variety of medical conditions," the committee writes. "These groups were called closed groups and often had the word 'anonymous' in their name, suggesting that information shared within the group and even membership in the group would be private."

The complaint states that users of these groups "shared deeply personal health information, such as information about substance use disorders, about the challenges of parenting transgender children, HIV status, and past history of sexual assault," the committee letter says.

"Despite the indications that the groups were private and anonymous, people and companies who should not have been admitted to these groups gained access to them and to lists of group members," the committee letter states.

"People used the member lists and other information from these groups to target and harass members of the groups. Insurance companies may have used information from these private groups to make decisions about insurance offerings for group members."

Lack of Transparency

The consumer complaint raises a number of concerns about Facebook's privacy policies and practices, the committee's letter adds.

"Facebook's systems lack transparency as to how they are able to gather personal information and synthesize that information into suggestions of relevant medical condition support groups. Labeling these groups as closed or anonymous potentially misled Facebook users into joining these groups and revealing more personal information than they otherwise would have," the letter notes.

In addition, the letter states, "Facebook may have failed to properly notify group members that their personal health information may have been accessed by health insurance companies and online bullies, among others."

Facebook and the Energy and Commerce Committee did not immediately respond to Information Security Media Group's requests for comment on the allegations.

The FTC confirmed to ISMG that it received the complaint but declined to comment.

Other Battles

Meanwhile, Facebook reportedly is continuing to negotiate a massive proposed settlement with the FTC over other privacy failures (see: Report: Facebook Faces Multibillion Dollar US Privacy Fine).

FTC staff have discussed a fine of up to $5 billion against Facebook, The Wall Street Journal reports.

Facebook's practices are also facing harsh criticism from regulators in other countries.

For instance, a final report issued by the U.K. Parliament's Digital, Culture, Media and Sport Committee on Monday accuses Facebook of actively attempting to block efforts to understand how its targeted advertising ecosystem functions, acting as if it has a monopoly on personal information and generally behaving "like 'digital gangsters' in the online world, considering themselves to be ahead of and beyond the law." (See: Facebook Smackdown: U.K Seeks Digital Gangster Regulation).

In addition, Germany's competition authority has said that it wants to see "an internal divestiture of Facebook's data," so that users have meaningful input into how the social media company uses their personal information (see: German Antitrust Office Restricts Facebook Data Processing).

Fraud Management & Cybercrime , Governance , Privacy

But Can New Laws and Greater Oversight Fix UK's 'Fake News' Challenges?(euroinfosec) • February 20, 2019    Facebook Smackdown: UK Seeks 'Digital Gangster' RegulationThe House of Commons released this photograph in response to Facebook CEO Mark Zuckerberg's failure to testify on Nov. 27. 2018, before its probe into disinformation and "fake news."

Technology giants are threatening British society via their naked pursuit of "profit over data security," functioning as monopolies and blocking attempts to hold them to account, a Parliament committee concludes. But the U.K.'s electoral system is also "not fit for purpose" in the era of disinformation and "fake news" campaigns being propagated via social media platforms and targeted advertising, the committee says.

See Also: Sunset of Windows Server 2008: Migrate with Docker

Those findings are contained in a final report issued by Parliament's Digital, Culture, Media and Sport Committee on Monday. It warns that "the ubiquity of social media" has a polarizing effect that amplifies "propaganda and politically aligned bias," which "reduces the common ground on which reasoned debate, based on objective facts, can take place."

The committee has been investigating disinformation and fake news in the wake of the Cambridge Analytica scandal and nation-state election interference campaigns targeting western democracies.

The ability to weaponize social media platforms is unlikely to go away. But technology giants have worked to actively disrupt attempts to unravel how their operations work and how they put users and non-users alike at risk of harm, the committee says.

'Profit Over Data Security'

The report accuses Facebook in particular of actively attempting to block efforts to understand how its targeted advertising ecosystem functions, acting as if it has a monopoly on personal information and generally behaving "like 'digital gangsters' in the online world, considering themselves to be ahead of and beyond the law."

But the committee reserves especial scorn for Facebook CEO Mark Zuckerberg, pointing to his failure to testify before Parliament. Instead, Zuckerberg issued a Facebook post, saying to the committee: "We look forward to continuing our collaboration."

The committee has slammed Zuckerberg, saying he "continues to choose profit over data security." It also accuses him of talking out of both sides of his mouth about giving users meaningful control of the data that the social network holds on them. For example, Zuckerberg in April 2018 told Congress that "you should have complete control over your data" and that "if we're not communicating this clearly, that's a big thing we should work on" (see: Facebook to Congress: We Shared More Data Than We Said).

But the committee's report notes: "The advertising profile that Facebook builds up about users cannot be accessed, controlled or deleted by those users. It is difficult to reconcile this fact with the assertion that users own all 'the content' they upload."

Lack of Transparency Into Election Spending

At the same time, however, U.K. election laws make it easy to hide "who is spending what, and where and how" in the words of a June 2018 Electoral Commission report - or to impose meaningful sanctions against offenders, according to the DCMS report.

"Electoral law is not fit for purpose and needs to be changed to reflect changes in campaigning techniques, and the move from physical leaflets and billboards to online, micro-targeted political campaigning," the report says. "There needs to be: absolute transparency of online political campaigning, including clear, persistent banners on all paid-for political adverts and videos, indicating the source and the advertiser; a category introduced for digital spending on campaigns; and explicit rules surrounding designated campaigners' role and responsibilities."

Life After Cambridge Analytica

Facebook data ended up in the hands of Cambridge Analytica, the now-defunct analytics firm that worked on President Donald Trump's election campaign for about five months and also worked with the "Leave" campaign during Britain's 2016 "Brexit" referendum on its EU membership.

Conservative Party MP Damian Collins, chair of the DCMS committee, told Time in January that the Cambridge Analytica scandal catalyzed concerns over the impact of social media on British society, making the general public realize "that content is targeted at people in ways they don't often see or understand."

Collins told Time: "The ethics of that, and the mechanism for doing that, became a really important part of the inquiry as well." He also said the probe was taking a hard look in particular at Zuckerberg, who has a "pattern of avoiding scrutiny."

Seeking Ethical Oversight, More Transparency

Beyond potentially reforming U.K. electoral law, however, can tech giants also be brought to heel?

Here's the DCMS committee's proposal: "The big tech companies must not be allowed to expand exponentially, without constraint or proper regulatory oversight," the report states. "But only governments and the law are powerful enough to contain them. The legislative tools already exist. They must now be applied to digital activity, using tools such as privacy laws, data protection legislation, antitrust and competition law."

The report says that if any technology firm is found to have gotten too large, giving it a monopoly, then it should be broken up.

Beyond added transparency, DCMS also wants to see ethical oversight of social media platforms become a regulatory mandate, especially as some companies stand accused of prioritizing profits over the public good.

"Facebook's handling of personal data, and its use for political campaigns, are prime and legitimate areas for inspection by regulators, and it should not be able to evade all editorial responsibility for the content shared by its users across its platforms," the committee's report says.

Efforts in Germany, France, US

Arguably, the U.K. has been slow off the mark, despite London-based Cambridge Analytica having been tied to pro-Brexit efforts.

Germany's competition authority has said that it wants to see "an internal divestiture of Facebook's data," so that users have meaningful input into how the social media uses their personal information (see: German Antitrust Office Restricts Facebook Data Processing).

Under the EU's General Data Protection Regulation, France's National Data Protection Commission, abbreviated as CNIL, has also slammed a $57 million fine on Google. CNIL says the technology giant - including its targeted advertising personalization model - does not currently comply with GDPR and must come into compliance as quickly as possible (see: France Hits Google With $57 Million GDPR Fine).

France and Germany both have advanced efforts to combat election inference (see: Au Revoir, Alleged Russian 'Fancy Bear' Hackers).

In January, the German Ministry for Information Security and Facebook announced that they were working together to combat disinformation campaigns, as they did in 2017, ahead of this spring's EU elections.

Regulators in the United States also have Facebook in their sights, with the company continuing to negotiate a massive proposed settlement with the Federal Trade Commission over its privacy failures (see: Report: Facebook Faces Multibillion Dollar US Privacy Fine).

FTC staff have discussed a fine of up to $5 billion against Facebook, even as Congress has failed to introduce a single bipartisan privacy rights bill, The Wall Street Journal reports.

Authentication , Data Loss , Forensics

Popular Password Managers for Windows Fail to Tidy Up Before Locking Up Shop(jeremy_kirk) • February 20, 2019    Password Managers Leave Crumbs in Memory, Researchers Warn

An audit of some popular password managers for Windows has revealed concerning weaknesses. Luckily, none of the problems are showstoppers that should put people off using such applications.

See Also: Live Webinar: Building Secure Delivery Pipelines with Docker, Kubernetes, and Trend Micro

Baltimore-based Independent Security Evaluators on Tuesday released the results of their look into the Windows versions of LastPass, KeePass, Dashlane and 1Password. The researchers found that the applications failed to scrub bits of data left in memory, which pose a risk if an attacker has physical access to the machine.

"We were surprised in the inconsistency in secrets sanitization and retention in memory when in a running unlocked state and, more importantly, when placed into a locked state," ISE writes in its report. "If password managers fail to sanitize secrets in a locked running state, then this will be the low hanging fruit that provides the path of least resistance to successful compromise of a password manager running on a user's workstation."

Password managers are incredibly valuable tools in the age of data breaches. Most have built-in password generators, which can create and manage a unique password for every different site or service a user uses. That's important because account takeovers are often caused by people reusing passwords that have already been stolen by hackers. Many information security experts also recommend that everyone use a password manager.

But as with any software, there are risks. Password managers usually get unlocked with a master password, which is the key to all of the other sensitive data and thus a potential single point of failure. Like any application, password managers also interact with a computer's operating system and memory, so it's important for maximum security that the applications leave as few digital traces behind as possible.

The developers of password managers do care about security and have hardened their infrastructure and properly use strong cryptography, says Adrian Bednarek, a senior security analyst and researcher with ISE. But clients and users remain the weakest link, which is why traces of password data on a computer could pose a risk if it was compromised, he says.

"We wanted to bring to light that password managers running on users computers should employ all possible defenses to protect them against existing and emerging threats," Bednarak says.

1Password: Not Enough Scrubbing

So here's the good news, in short form, first: All of the tested applications adequately protected their stored passwords and master passwords when they were not running. Even if an attacker had access to a local machine, no useful information could be collected.

None of the weaknesses found by ISE can be remotely exploited over the internet.

Less encouraging, however, was a look at when password managers had either been unlocked or else unlocked and locked again.

imageISE found all of the tested password managers left data in memory. (Source ISE)

Versions of 1Password appear to have had the most problems. ISE found 1Password4 leaves an obfuscated version of the master password in memory after the application has been unlocked. Although it was obfuscated, ISE was able to reverse two strings to reveal the clear text.

The current release, 1Password7, was more problematic. The lock mechanism was essentially ineffective, ISE writes.

"We found that 1Password7 scrubs neither the individual passwords, the master password, nor the secret key (an extra field introduced in 1Password6 that combines with the master password to derive the encryption key) from memory when transitioning from unlocked to locked," ISE writes.

The only way to clear that data is to quit 1Password7 completely, which then flushes the data from memory. ISE also stumbled across a kernel mode exception bug in 1Password7 caused by an unrelated hardware issue.

"While examining this memory dump file, we came across our secrets that 1Password7 held cleartext [sic], in memory, in a locked state when the stop error occurred," ISE writes.

1Password had to make development tradeoffs that limited its ability to clear data from memory immediately, says Jeffrey Goldberg, who is 1Password's chief defender against the dark arts.

Long term, we may not need to make such a tradeoff," Goldberg tells ISMG. "But given the tools and technologies at our disposal, we have had to make a decision as to how best to keep our users secure. I stand by our decision."

Goldberg says that the realistic threat from the issues are limited. Further, no application can run safely on a computer where an attacker has access to memory. 1Password addressed the research on it forum.

"This is a well-known issue that's been publicly discussed many times before, but any plausible cure may be worse than the disease," Golderberg says.

Dashlane, KeePass, LastPass

Dashlane also exposes its full password database in a locked and unlocked state, ISE found. Usually, only the last password a person has used is left in memory. But for some reason, ISE found that if a user updated an entry, the entire database is exposed in clear text in both a locked and unlocked state.

Dashlane CEO Emmanuel Schalit tells ISMG that the risk outlined by the research - where someone gains local control of a machine and accesses data in memory - is a weakness shared by any application on a computer. He warned that the research shouldn't put off people from using password managers, as the benefits outweigh the risks.

"It is generally well known in the world of cybersecurity that the above scenario is an extreme one, in the sense that no mechanism can protect the digital information on a device if that device is already entirely compromised," Schalit says.

KeePass exposes some clear text data in memory, but on the positive side, the master password is unrecoverable. Although KeePass is supposed to wipe out data, ISE writes that KeePass indicated that Windows OS APIs "may make copies of various memory buffers which may not be exposed to KeePass for scrubbing."

imagePassword managers are used by tens of millions of users, making their security critical. (Source: ICE)

Decrypted passwords also continue to live in memory in LastPass version 4.1.59, which is not the latest version. The master password also "leaked into a string buffer in memory and never scrubbed, even when LastPass is placed into a locked state," ISE writes.

KeePass's developer, Dominik Reichl, says what ISE found is a well-known issue with password managers. KeePass discusses it in its technical notes.

LastPass has already addressed the findings.

On Wednesday, a LastPass spokeswoman said the bugs have been addressed in an update for LastPass for Applications, which is a paid-for feature for LastPass. She added that the version tested by ISE is used by less than 0.2 percent of its users and that "we have no indication or reason to believe that any sensitive LastPass user data has been compromised."

The spokeswoman also said that attackers would need local and administrator access to a compromised computer. That's an important point that applies to all of the problems found by ISE. None of the weaknesses found by ISE could be remotely exploited over the internet, which would be a far more dangerous scenario.

Still, ISE points out that it's common for administrators to image machines that have been compromised by malware as part of incident response. That means memory files, crash logs or debugging logs may be copied and stored in other places. If this happened to someone running 1Password7, for example, the person "should assume that all secrets have been compromised," the report says.

Bednarek adds: "A locked password manager should not expose secrets, and we're glad to see steps are being taken to reduce the likelihood of sensitive information exposure to adversarial activity."

A BA plane Image copyright Getty Images Image caption BA customers were caught out by an attack that sought to steal payment card information

Thousands of websites are being hit by cyber-thieves who implant code to scoop up payment card numbers, research suggests.

Security giant Symantec found more than 4,800 websites were being hit by these "form-jacking" attacks every month.

High-profile victims of these attacks include airline BA and Ticketmaster.

Online crime groups had turned to the attacks as other more established techniques proved less and less lucrative, Symantec said.

'Attack code'

"It's a sign we're in a world where security is tighter and tighter and it's getting harder to carry out this type of activity," said Orla Cox, director of Symantec's security response unit.

Formerly profitable ventures involving ransomware and mining crypto-currencies now made gangs much less money, she said.

Instead, they were now inserting "attack code", either when sites failed to update core software to close loopholes or via insecure third-party apps, such as chat apps, analytics packages or other extras.

"It's a tiny line of code in there and that's enough for attackers to monitor payment card info being entered and they siphon it off," she said.

"Its often not obvious that the website has been compromised.

"To the naked eye everything would look fine."

Make money

Last year, Symantec had stopped more than 3.7 million form-jacking attacks, said Ms Cox, adding that the figure was a measure of the technique's sudden popularity.

"Cyber-criminals are continuing to find new ways to make money," she said. "And when they do, they pile in."

Ransomware was also still widely used, said Ms Cox, but better back-up practices by businesses and home users meant it was harder for criminals to secure a payday. And infections from ransomware had fallen by 20% over the past year.

"In a lot of cases people are not paying up because its got easier for them to get their data back as they often have it in the cloud somewhere," she said.

A new study investigating the true security posture of password storage services has uncovered a swathe of vulnerabilities which can lead to the theft of valuable user credentials -- but this does not mean you should abandon your favorite password manager any time soon.

Independent Security Evaluators (ISE) published an assessment on Tuesday which documented the results of tests involving 1Password, Dashlane, KeePass and LastPass, all of which are popular password managers available today.

1Password4 for Windows version 4.6.2.626, 1Password7 for Windows 7.2.576, Dashlane for Windows v.6.1843.0, KeePass Password Safe v.2.40, and LastPass for Applications version 4.1.59 were tested. 

The team said that each password management solution "failed to provide the security to safeguard a user's passwords as advertised" and "fundamental flaws" were found that "exposed the data they are designed to protect."

The vulnerabilities were found in software operating on Windows 10 systems. In one example, the master password which users need to use to access their cache of credentials was stored in PC RAM in a plaintext, readable format.

"Users are led to believe the information is secure when the password manager is locked," ISE says. "Though, once the master password is available to the attacker, they can decrypt the password manager database -- the stored secrets, usernames, and passwords."

ISE was able to extract these passwords and other login credentials from memory while the password manager in question was locked. It may be possible that malicious programs downloaded to the same machine by threat actors could do the same.

The main findings based on each password management solution are below:

1Password4: ISE says "reasonable" protections are in place in unlocked states, but when there is a transition from an unlocked to a locked state, the master password reportedly remains in memory when unlocked -- despite some obfuscation -- and the software fails to scrub this master password sufficiently before the transition has finished.

However, when a user accesses different entries in the software, unencrypted passwords are cleared from memory before another is loaded.

"We also found a bug where, under certain user actions, the master password can be left in memory in cleartext even while locked," ISE says.

1Password7: The current release of the software, in the security researcher's opinion, is "less secure" than the legacy version. Rather than only keeping one entry at a time in memory, this version of 1Password decrypted all individual passwords in a database upon testing, and also did not scrub individual passwords, the master password, or the secret key used to derive the encryption key when moving from the unlocked state to locked.

"This renders the "lock" button ineffective; from the security standpoint, after unlocking and using 1Password7, the user must exit the software entirely in order to clear sensitive information from memory as locking should," the researchers added.

Jeffrey Goldberg, 1Password's "Chief Defender Against the Dark Arts," said:

"This is a well-known issue that's been publicly discussed many times before, but any plausible cure may be worse than the disease. Fixing this particular problem introduces new, greater security risks, and so we have chosen to stick with the security afforded by high-level memory management, even if it means that we cannot clear memory instantly.

Long term, we may not need to make such a tradeoff. But given the tools and technologies at our disposal, we have had to make a decision as to how best to keep our users secure. I stand by our decision.

The realistic threat from this issue is limited. An attacker who is in a position to exploit this information in memory is already in a very powerful position. No password manager (or anything else) can promise to run securely on a compromised computer."

Dashlane: In Dashlane's case, the researchers say that memory/string, GUI management, and workflows were implemented to reduce the risk of credentials extraction. Only one active entry was ever exposed in RAM, but ISE added that when entries are updated, Dashlane exposes "the entire database plaintext in memory and it remains there even after Dashlane is logged out of or locked."

A Dashlane spokesperson told ZDNet:

"It is indeed correct that if an attacker has full control of a device at the lowest operating systems level, they can read any and every information on the device. This is not the case just with Dashlane or with password managers, but of any software or in fact any device that stores digital information.

For that reason, it is generally well known in the world of cybersecurity that the above scenario is an extreme one, in the sense that no mechanism can protect the digital information on a device if that device is already entirely compromised."

See also: Key takeaways from damning UK report on Facebook's world of "digital gangsters"

KeePass: KeePass scrubs the master password from memory and is not recoverable. However, errors in workflows permitted the researchers from extracting credential entries which have been interacted with. In the case of Windows APIs, sometimes, various memory buffers which contain decrypted entries may not be scrubbed correctly.

KeePass told ZDNet that what the researchers found "is a well-known and documented limitation of the process memory protection."

The company's security guidelines say:

"For some operations, KeePass must make sensitive data available unencryptedly in the process memory. For example, in order to show a password in the standard list view control provided by Windows, KeePass must supply the cell content (the password) as unencrypted string (unless hiding using asterisks is enabled).

Operations that result in unencrypted data in the process memory include, but are not limited to: displaying data (not asterisks) in standard controls, searching data, replacing placeholders (during auto-type, drag&drop, copying to clipboard, ...), and importing/exporting (except KDBX).

Windows and .NET may make copies of the data (in the process memory) that cannot be erased by KeePass."

LastPass: LastPass obfuscates the master password while users are typing in the entry, and when the password manager enters an unlocked state, database entries are only decrypted into memory when there is user interaction. However, ISE reported that these entries persist in memory after the software enters a locked state. It was also possible for the researchers to extract the master password and interacted-with password entries due to a memory leak.

LastPass CTO Sandor Palfy said:

"This particular vulnerability, in LastPass for Applications, our legacy, local Windows Application (which accounts for less than .2 percent of all LastPass usage) was brought to our attention by researchers through our Bug Bounty Program. 

In order to read the memory of an application, an attacker would need to have local access and admin privileges to the compromised computer. We have already implemented changes to LastPass for Applications designed to mitigate and minimize the risk of the potential attack detailed in this report. 

To mitigate the risk of compromise while LastPass for Applications is in a locked state, LastPass for Applications will now shut down the application when the user logs out, clearing the memory and not leaving anything behind."

A patch resolving the issue has also been released. 

TechRepublic: The year 2018 was the second most active year on record for data breaches, report says

"This paper is not meant to criticize specific password manager implementations; however, it is to establish a reasonable minimum baseline which all password managers should comply with," ISE says. "It is evident that attempts are made to scrub and sensitive memory in all password managers. However, each password manager fails in implementing proper secrets sanitization for various reasons."

Despite these problems, it is worth noting that in a world where brute-force attacks can be automated and are commonplace, a password manager is still a better alternative than using the same simple, easy-to-crack passwords across the board.

In terms of risk factors, you are more at risk of using simple passwords than a malicious program compromising a home PC with the sole purpose of scouring RAM for evidence of a password manager being in play.

CNET: Facebook faces questions from lawmakers about privacy of health groups

While password manager software developers should be aware of these potential security risks, not everyone has considered the report with a friendly eye. According to Cyberscoop, ISE researcher Adrian Bednarek was removed from the bug bounty hunter platform Bugcrowd on the basis of "unauthorized disclosure" after revealing the LastPass bug to a reporter ahead of the report being published.

Previous and related coverage

Nest Guard Image copyright Google Image caption The Nest Guard contained a microphone, but Google did not disclose that in the product's specifications

Google has acknowledged that it made an error in not disclosing that one of its home alarm products contained a microphone.

Product specifications for the Nest Guard, available since 2017, had made no mention of the listening device.

But earlier this month, the firm said a software update would make Nest Guard voice-controlled.

On Twitter, concerned Nest owners were told the microphone "has not been used up to this point”.

Business Insider was first to report the development.

The Nest Guard is one component in the Nest Secure range of home security products. The system includes various sensors that can be monitored remotely by the user.

Nest Guard is an all-in-one alarm, keypad, and motion sensor but, despite being announced well over a year ago, the word “microphone” was only added to the product’s specification this month.

The change coincided with the announcement that it was now compatible with Google Assistant.

Image copyright Google Image caption The Nest Guard acts as a way to arm and disarm the firm's home security alarm system by use of a code or tap of a key fob

In response to criticism, Google said on Tuesday: "The on-device microphone was never intended to be a secret and should have been listed in the tech specs. That was an error on our part.”

It added: “The microphone has never been on and is only activated when users specifically enable the option.

"Security systems often use microphones to provide features that rely on sound sensing. We included the mic on the device so that we can potentially offer additional features to our users in the future, such as the ability to detect broken glass.”

The firm's mea culpa has been accepted as genuine by many company watchers, but some say it still raises significant privacy concerns.

"This is the kind of thing that makes me paranoid of smart home devices," commented Nick Heer, who writes the Pixel Envy blog.

"If I owned one of these things and found out that the world's biggest advertising company hid a microphone in my home for a year, I'd be livid."

UK-based privacy campaign group Big Brother Watch added: "Many of our worries about smart home devices appear to be proving true... Google should be held to account for wrongly advertising this product."

Nest Guard went on sale in the US last year as part of Google's Secure alarm system. A European and Canadian release is also planned but has yet to occur.

Nest, a company known for its smart thermostat, was acquired by Google in February 2014, for a reported $3.2bn (£2.5bn).

The acknowledgment comes days after Singapore Airlines faced criticism for installing cameras into the backs of some of its planes' seats as part of a new in-flight entertainment system.

Image copyright Twitter

The company confirmed the cameras' existence on Sunday, but said they had been disabled and added that it had no plans to use them.

____

Additional reporting by Leo Kelion

Follow Dave Lee on Twitter @DaveLeeBBC

Do you have more information about this or any other technology story? You can reach Dave directly and securely through encrypted messaging app Signal on: +1 (628) 400-7370

WinRAR, a Windows file compression program with 500 million users worldwide, recently fixed a more than 14-year-old vulnerability that made it possible for attackers to execute malicious code when targets opened a booby-trapped file.

The vulnerability was the result of an absolute path traversal flaw that resided in UNACEV2.DLL, a third-party code library that hasn’t been updated since 2005. The traversal made it possible for archive files to extract to a folder of the archive creator’s choosing rather than the folder chosen by the person using the program. Because the third-party library doesn’t make use of exploit mitigations such as address space layout randomization, there was little preventing exploits.

Researchers from Check Point Software, the security firm that discovered the vulnerability, initially had trouble figuring out how to exploit the vulnerability in a way that executed code of their choosing. The most obvious path—to have an executable file extracted to the Windows startup folder where it would run on the next reboot—required WinRAR to run with higher privileges or integrity levels than it gets by default.

To clear that hurdle, the researchers wrote a proof-of-concept exploit that misrepresented the startup folder—“C:C:C:..AppDataRoamingMicrosoftWindowsStart MenuProgramsStartupsome_file.exe” instead of “C:..AppDataRoamingMicrosoftWindowsStart MenuProgramsStartupsome_file.exe”—after discovering that a filter function in UNACEV2 library would convert it to the latter location. With that, they created an exploit that dropped code of their choice into the Windows startup, where it would be executed the next time Windows rebooted. In release notes published late last month, WinRAR officials said they patched the vulnerability.

“UNACEV2.DLL had not been updated since 2005 and we do not have access to its source code,” the officials wrote. “So we decided to drop ACE archive format support to protect security of WinRAR users.”

The code-execution vulnerability in WinRAR has existed the entire 14 years since the UNACEV2 library was created, and possibly earlier, Check Point researchers said in a blog post. In the same post, they compared their proof-of-concept exploit to zero-day attacks exploit broker Zerodium said it would buy for as much as $100,000.

It’s not clear it’s an apt comparison. The phrasing of Zerodium’s tweet suggests the broker may have been looking for a generic exploit that would work against multiple compression programs. The proof-of-concept exploit, by contrast, works only on WinRAR. The more significant impact of Check Point’s research may be the fallout created if other apps that bundle UNACEV2 suffer from similar traversal vulnerabilities.

Microsoft-owned code-hosting site GitHub has removed the cap on its top payout under its bug bounty and made the program less legally risky for researchers.

GitHub is giving its five-year-old security bug bounty a refresh with higher rewards, more products in scope for rewards, and new legal protections for hackers.

The company has removed the limit on the maximum it will pay researchers for finding critical bugs. In general, researchers could expect between $20,000 and $30,000 for critical bugs, but GitHub says it will reward "significantly more for truly cutting-edge research". 

It's also raising rewards at lesser levels. High-severity bugs will offer rewards between $10,000 to $20,000, medium-severity rewards range between $4,000 and $10,000, while low-severity rewards are between $617 to $2,000. 

"We regularly assess our reward amounts against our industry peers. We also recognize that finding higher-severity vulnerabilities in GitHub's products is becoming increasingly difficult for researchers and they should be rewarded for their efforts. That's why we've increased our reward amounts at all levels," said GitHub's Phil Turnbull. 

Now all first-party services hosted under the GitHub.com domain are in scope for rewards, including GitHub Education, GitHub Leaning Lab, GitHub Jobs, and the GitHub Desktop application. GitHub's Enterprise Cloud is now also included in the program, as are its employee-facing sites, githubapp.co and github.net domains.  

Finally, GitHub wanted to remove some of the legal risks that its bug-bounty program exposed researchers to if they violated the site terms in the name of security research. To address this issue, GitHub has added a new set of Legal Safe Harbor terms to its site policy with clearly stated protections. 

SEE: 10 tips for new cybersecurity pros (free PDF)

With the new Legal Safe Harbor, researchers are shielded from violating GitHub's site terms if their actions are specifically for bug-bounty research. Researchers can now safely disregard GitHub's Enterprise Agreement restrictions on reverse-engineering. 

GitHub also vows not to sue researchers if they accidentally overstep the bounty's scope, and to protect researchers from third parties who don't offer the same level of safe-harbor protections.  

"To encourage research and responsible disclosure of security vulnerabilities, we will not pursue civil or criminal action, or send notice to law enforcement for accidental or good-faith violations of this policy," GitHub's safe-harbor terms read. 

"We consider security research and vulnerability disclosure activities conducted consistent with this policy to be 'authorized' conduct under the Computer Fraud and Abuse Act, the DMCA, and other applicable computer use laws such as Cal. Penal Code 502(c). We waive any potential DMCA claim against you for circumventing the technological measures we have used to protect the applications in this bug-bounty program's scope."

Previous and related coverage

Microsoft is going all-in on 'Inner Source'

Microsoft is staffing up an internal Inner Source initiative to bring open-source principles, methodologies and tools for use by development teams inside the company.

GitHub to give users of its free plan access to unlimited private repositories

Microsoft is making GitHub's private repositories free to smaller developers and teams, which could help Microsoft go head-to-head with GitLab and BitBucket.

Microsoft's GitHub: Requests for user data double in 2018, but gag orders grow faster

GitHub in most cases is legally prevented from informing users when it provides information to law enforcement.

GitHub to give users of its free plan access to unlimited private repositories

Microsoft is making GitHub's private repositories free to smaller developers and teams, which could help Microsoft go head-to-head with GitLab and BitBucket.

Microsoft's GitHub: 'Kotlin for Android now fastest-growing programming language'

The number of developers hosting projects built with Google-backed Kotlin is surging.

Microsoft finalizes its $7.5 billion GitHub acquisition

Microsoft's acquisition of GitHub has passed regulatory approval and is now official.

Microsoft open sources MS-DOS again, this time on GitHub

Microsoft has made the MS-DOS 1.25 and 2.0 source code available on GitHub for reference purposes only.

The 3 next big programming languages: GitHub's rising stars for 2018 TechRepublic

These are the languages with the largest growth in contributors to code repositories over the past year.

Google exec says it's OK Microsoft nabbed GitHub CNET

Countless programmers use GitHub to cooperate on projects. Google's cloud chief says she wouldn't have minded being the buyer.

  1. Post-Breach HIPAA Enforcement: A Call for 'Safe Harbors'
  2. Wendy's Reaches $50 Million Breach Settlement With Banks
  3. Police Push Free Decryptor for GandCrab Ransomware
  4. Suspected State-Sponsored Hackers Pummel US and Australia

Page 285 of 354