Mobile apps spying on you - It seems that there are two class action lawsuits that have been filled against Apple. Apple having tight control over apps that get posted on the iPhone app store has set itself up for this. Control also means responsibility and consumer feel cheated if they discover that Apple allows applications to spy on them.
Cloud based services and the risks - The latest victim of its cloud technology seem to be Skype, which had major outages right around the Christmas time. The service blames older clients to be the source for the outage. Those clients shutdown/crashed when receiving certain offline messages that arrived delayed. This just shows that cloud technology creates super complex systems that are not yet well understood and difficult to test for all scenarios.
Read more:
Two lawsuits target Apple, app makers over privacy concerns
Skype's mega-FAIL: exec cops to cause
1SSA - Security Consulting, Training and Products
Thursday, December 30, 2010
Sunday, December 26, 2010
Cloud based services and the risks
The cloud is here, and it is here to stay...
Having worked in the outsourcing business for some time it is quite entertaining to see how the marketing folks sell you the same old car over and over again, just by changing the sales pitch. What I am trying to say is that the cloud is just a collection of technologies that already existed before, being sold as part of a regular outsourcing deal: Virtualization, data centers in cheap labor countries, and network capacity are nothing new. But what are the risks?
Many of the cloud solutions had outages according to various websites tracking these outages. Leaving sometimes customer with a total loss of data (E.g. T-Mobile's Sidekick outage).
Other times your privacy of your personal or business data is at risk (E.g. Health care records stolen).
Reading through the fine print (see screenshot) of some of those cloud based services, you will notice that you just provided them with the permission to circumvent the local law. Agreeing to have your data stored "somewhere", where the laws of the country your reside in, might or might not protect your data.
Read more:
Cloud Privacy report - World Privacy Forum
Top-10 cloud outages in 2010
1SSA - Security Consulting, Training and Products
Having worked in the outsourcing business for some time it is quite entertaining to see how the marketing folks sell you the same old car over and over again, just by changing the sales pitch. What I am trying to say is that the cloud is just a collection of technologies that already existed before, being sold as part of a regular outsourcing deal: Virtualization, data centers in cheap labor countries, and network capacity are nothing new. But what are the risks?
Many of the cloud solutions had outages according to various websites tracking these outages. Leaving sometimes customer with a total loss of data (E.g. T-Mobile's Sidekick outage).
Other times your privacy of your personal or business data is at risk (E.g. Health care records stolen).
Reading through the fine print (see screenshot) of some of those cloud based services, you will notice that you just provided them with the permission to circumvent the local law. Agreeing to have your data stored "somewhere", where the laws of the country your reside in, might or might not protect your data.
Read more:
Cloud Privacy report - World Privacy Forum
Top-10 cloud outages in 2010
1SSA - Security Consulting, Training and Products
Sunday, December 19, 2010
Mobile apps spying on phone users
Do you like listening to Pandora? According to a a study conducted by Wallstreet Journal you better be prepared to offer some of your private details. The Pandora application on iPhone, according to the article, sends information about you to at least eight (8!) tracking services that gather information. This is not unusual according to the article. Most of the 101 apps tested showed evidence that they provide information ranging from a unique phone ID up to location information, age, Zip code and gender to tracking companies. The article also mentions that iPhone apps seem to be worse than their siblings on Google's Android platform.
Apple claims to review all applications before being allowed in the iPhone app store. This has caused a false sense of privacy with users. All of the apps reviewed by WSJ were available in Apple's app store.
Blackberry applications were not reviewed but the model RIM (maker of Blackberry) introduced in it's Blackberries a different security model. Access to certain information can be blocked. The user needs to deny the application the "trusted application" status and allow just access to individual information.
Read the WSJ article here: iPhone and Android Apps breach privacy
1SSA - Security Consulting, Training and Products
Apple claims to review all applications before being allowed in the iPhone app store. This has caused a false sense of privacy with users. All of the apps reviewed by WSJ were available in Apple's app store.
Blackberry applications were not reviewed but the model RIM (maker of Blackberry) introduced in it's Blackberries a different security model. Access to certain information can be blocked. The user needs to deny the application the "trusted application" status and allow just access to individual information.
Read the WSJ article here: iPhone and Android Apps breach privacy
1SSA - Security Consulting, Training and Products
Sunday, August 15, 2010
The big information security illusion
Now for years various vendors have worked to bring the various worlds together: IT, mobile phone service and physically security. The new thinking of "Everything is secure as long as the end point is secure" might not work out. Countries like Saudi Arabia or UAE pretty much told Blackberry manufacture RIM "Too much security/privacy" and are either thinking about, or already have made Blackberries illegal in their respective country.
Someone might say "Oh well not that big of a deal"...but this was just the start. Now IT outsourcing country #1 joins the club of Blackberry "haters" - India. What could that mean? For example software token solutions installed on your Blackberry used for multi-factor authentication could potentially be eavesdropped on by the Indian government. Some of them utilize SMS text messages to provide codes to users. Those codes are used to authenticate against IT systems requiring stronger authentication due to the sensitivity of the data stored on them. Some governments (e.g. Germany) already have advised to not use RIM devices for sensitive information.
Read more: Wallstreet Journal article
1SSA - Security Consulting, Training and Products
Someone might say "Oh well not that big of a deal"...but this was just the start. Now IT outsourcing country #1 joins the club of Blackberry "haters" - India. What could that mean? For example software token solutions installed on your Blackberry used for multi-factor authentication could potentially be eavesdropped on by the Indian government. Some of them utilize SMS text messages to provide codes to users. Those codes are used to authenticate against IT systems requiring stronger authentication due to the sensitivity of the data stored on them. Some governments (e.g. Germany) already have advised to not use RIM devices for sensitive information.
Read more: Wallstreet Journal article
1SSA - Security Consulting, Training and Products
Wednesday, February 03, 2010
From Enigma to Infinion's security chip...
During Blackhat DC 2010 Christopher Tarnovsky a researcher announced that he had broken through the defense mechanisms of Infineon's security chip. The chip has multiple mechanisms to protect itself from tempering with it. Making it the choice for many vendors to implement it in its devices. As the German Enigma during World War II has shown nothing holds for ever. Now Infineon, a German company, has to see once again that blind trust in its engineering is a recipe for the wrong attention. In this case Mr. Tanovsky worked his way step by step through the defense mechanism of the chip, having in the end ultra-small needles tap into the data bus. He then could readout encryption keys and other internal data of the chip. Tarnovsky informed Infineon of the flaws he had discovered, but so far Infineon has not responded.
According to Dark-Reading he told the Black-Hat audience: "Their initial reaction was to tell me that what I'd done was impossible," he said. "Then when I sent them some video and the code that I just showed [to the Black Hat audience], they went quiet. I have not heard back from anybody."
History repeats and blind trust in your engineering is never a good idea.
Read more: http://mobile.darkreading.com/9287/show/575baa2ef08cb38a3077417686e53489&t=0cd88a4fad7a9f5ce08e7b67d7d418d3
1SSA - Security Consulting, Training and Products
Attend our Oracle Security classes - Learn how to secure your Oracle databases
According to Dark-Reading he told the Black-Hat audience: "Their initial reaction was to tell me that what I'd done was impossible," he said. "Then when I sent them some video and the code that I just showed [to the Black Hat audience], they went quiet. I have not heard back from anybody."
History repeats and blind trust in your engineering is never a good idea.
Read more: http://mobile.darkreading.com/9287/show/575baa2ef08cb38a3077417686e53489&t=0cd88a4fad7a9f5ce08e7b67d7d418d3
1SSA - Security Consulting, Training and Products
Attend our Oracle Security classes - Learn how to secure your Oracle databases
Sunday, January 17, 2010
Have you checked your billboard today?
Times are over were just IT devices were a target for hacker attacks. Years ago I read an article in 2600 magazine describing how to hack traffic bill boards, the one's that have the bright orange LED type displays, making them display a random message. Now that art has been brought to a new level, adopting to the new display technology and a networked world. Last Thursday drivers on one of Moscow's (Russia) busiest roads were confronted with some porn clip that was flickering off a 30-foot-by-20-foot (aproximately 10m x 6.5m) size electronic billboard. This resulted in a major traffic jam since drivers slowed down to catch the "message" that the billboard was trying to convey. According to news article the advertising firm that owns the billboard stated that hackers had broken into their system and switched the content to the adult material.
The more our society is networked and technologies are melted together, the more we expose ourselves to such juvenile hoaxes. In the end this one had some people being upset and others with a smile on their faces but it also could have been a nuclear power plant's controls that suddenly show Pac-man instead of the controls for the reactor.
1SSA - Security Consulting, Training and Products
Providing Solutions that protect your Assets and People in a changing world
The more our society is networked and technologies are melted together, the more we expose ourselves to such juvenile hoaxes. In the end this one had some people being upset and others with a smile on their faces but it also could have been a nuclear power plant's controls that suddenly show Pac-man instead of the controls for the reactor.
1SSA - Security Consulting, Training and Products
Providing Solutions that protect your Assets and People in a changing world
Friday, January 08, 2010
Y2K+10 it finally caught up with us
Europe, particular Germany, Europe's largest economy has been shaken by a glitch in a security chip that is implemented in most ATM and some credit cards. This chip allows for additional security and is in some cases the only way for merchants to accept cash-less payments. Due to the weak security of the magnet stripe on the back of ATM and credit cards that chip was implemented. Up to midnight December 31st 2009 everything was fine. After that suddenly cards were rejected. Now after close to a week of confusion finally the riddle is solved, most ATM machines and merchants can now accept payments again. And this only because thousands of payment terminals and ATMs have been patched with new software.
Rumors say that the source for this disaster is a programmer at a french company producing the chips, confusing the format (hexadecimal or decimal) of the expiration year. Thinking that the year is in hexadecimal format, which did not matter for 09 but making the value 10 (hex) suddenly become a 16 (dec) in the decimal system. Since ATM cards usually have a lifetime/expiration of 5 years in Europe those cards were being rejected. According to various sources over 30 Million German ATM/credit cards have been affected. Even ATM cards in Australia seem to be impacted.
1SSA - Security Consulting, Training and Products
Rumors say that the source for this disaster is a programmer at a french company producing the chips, confusing the format (hexadecimal or decimal) of the expiration year. Thinking that the year is in hexadecimal format, which did not matter for 09 but making the value 10 (hex) suddenly become a 16 (dec) in the decimal system. Since ATM cards usually have a lifetime/expiration of 5 years in Europe those cards were being rejected. According to various sources over 30 Million German ATM/credit cards have been affected. Even ATM cards in Australia seem to be impacted.
1SSA - Security Consulting, Training and Products
Friday, January 01, 2010
Promote moral behavior by a clean smell
New study suggest that a clean smell promotes moral behavior. According to this soon to be published study, led by a Brigham Young University professor, people are unconsciously fairer and more generous when they are in clean-smelling environments.
While there current study examined the influence of the physical environment on morality, Zhong and Liljenquist previously published a work that demonstrated an intimate link between morality and physical cleanliness. Their 2006 paper in Science reported that transgressions activated a desire to be physically cleansed.
So how can information security professionals make use of this knowledge? I guess that this might be a bigger challenge since criminals nowadays can sit thousands of miles away.
Read more:
Science Daily
1SSA - Security Consulting, Training and Products
While there current study examined the influence of the physical environment on morality, Zhong and Liljenquist previously published a work that demonstrated an intimate link between morality and physical cleanliness. Their 2006 paper in Science reported that transgressions activated a desire to be physically cleansed.
So how can information security professionals make use of this knowledge? I guess that this might be a bigger challenge since criminals nowadays can sit thousands of miles away.
Read more:
Science Daily
1SSA - Security Consulting, Training and Products
Subscribe to:
Posts (Atom)
Posts
