Security Basics Weekly

   Among other recent flack on large companies, Intel is another one on the list. It has been found that Intel’s management engine on their last three generations of processors has multiple security flaws. It does appear that someone would need at least network access to your pc to exploit one of these processors but as of yet the full extent of the problem is not known.

   If you have been watching the news lately you may have heard mention of another big hack this time on the company Uber. Uber fessed up to having kept a hack of data from 57 million of their user’s accounts secret for the last year. Uber made a statement that they know they should have said something about it earlier but didn’t. The fact that they kept this from the public, from people who were affected by it and had the right to know their information was in danger will put a very large trust barrier between them, and their customers and even drivers.

   Google, one of the bigger tech companies with their fingers in just about every pie has been up to some shady stuff. It was recently admitted by Google that they are tracking your phone, that is, even if you’ve turned off tracking settings and don’t have a sim card. While this invasion of privacy is and was a thing, google said they will be discontinuing this cell tower tracking method saying that it was a part of a never completed project. With super corporations like Amazon and Google it is probably safer to be on the skeptical side of things but we will see if they hold true to this promise.

A trend has started in the Cyber Security world, a trend for finding skilled qualified talent. It is becoming a more common thing for businesses to sponsor cyber security competitions based on possible scenarios presented more in the form of a game. This is however more than just a smart recruitment method, it is also a way to inspire young people to pursue careers in cyber security. There is a gap in this field with somewhere around a million jobs that are just waiting to be filled. It’s not just STEM that is needed, there is a security gap that is important to fill and I believe this competition trend is a start in the right direction.

   Here is a cool thing going on in the tech security world. Shannon Morse of hak5 (the people who make the wifi pineapple and other pen-testing tools) is making a short video every day for a month on how to make yourself more secure digitally. There are different topics each day made simple enough for most anyone to follow along to. That’s what makes this so good. It is good for those who have a strong computer background as they should be able to find one or two videos to educate them on security. It is also great for those who aren’t very computer savvy though they shouldn’t be completely computer illiterate. Each video is around five minutes long making each of them an easy watch and a small time commitment. You might want to wait for most of the rest of the videos as this started on November 1st and will be going on for thirty days total. So share this with anyone you think could really use it or share a part of it. The weakest link in cyber security is usually people and generally the ones who don’t know much about computer security, but if everyone who does know makes an effort to teach everyone who doesn’t, we should end up with a lot of much safer people and businesses.

Very recently a British citizen found a usb flash drive on the ground and decided to plug it into a library computer. This man had found the unencrypted documentation of all the security and blueprints of Heathrow Airport, Britain’s largest airport. The blueprints were not just the regular stuff like the terminals and the bathrooms, these had camera locations, tunnels used by dignitaries, and even routes used by the royal family. To say he stumbled upon some sensitive info would be an understatement. Due to the details of the blueprints and the fact they were just lying on the ground somewhere an investigation has been opened. The thought that someone in the airport could have been trying to sell the plans to a terror group or anything remotely similar are all still possibilities and not nice ones. For more info see the article below.

   Google very recently released a new feature with Google accounts that you can choose to turn on. The feature is called “Advanced Protection Program” and if you are willing to opt into it, it will up your security game keeping you much safer than using the current security settings. 

   The new settings implement a form of two factor authentication where you must have a physical key in addition to your password making it harder to hack unless someone gets physical access to your key and can crack your password. This form of 2FA is is far more secure than getting a code by text and somewhat better than an authenticator application.

   In addition to forcing this more secure authentication, this security setting makes it harder for just anyone to reset your password through email which is an method used by hackers to get control of people’s accounts.

   In the current article for the week is a story about a new exploit in Microsoft Word. Many people have heard of the ability to execute malicious code stored right in an MS Word document which was a big problem in the past seemingly from a design flaw in the file type or something of the like if I remember correctly. That actually got word document format files outlawed in space (namely the ISS). But as I said, that was awhile ago. Rather recently however, a new exploit just about as bad as the first has come to light. 

   This exploit is built off of an unsuspecting feature in word called DDE or  Dynamic Data Exchange. It allows programs to send information to each other and doesn’t get picked up by antimalware. It has been shown to have been used in the wild but only so far for very major high-profile attacks as far as I can tell. 

   Though this is a very bad thing there is fortunately a fairly easy way to guard against it. It just involves turning off a feature in word’s settings and is described with some good pictures in thehackernews’s article linked below. If you just use common sense and don’t open unknown or trusted word documents you should be fine but to be on the safe side turn off that setting too.

This week the computer security blogger Brian Krebs posted on his blog that he found some new information that researchers have discovered a really bad weakness that is being called “KRACK”. This is an inherent flaw in the WPA2 protocol and will allow any a successful attacker to do just about whatever they want on your network.

   It does appear though that this is only confirmed to affect properly implemented WPA2 networks so if you have set up your system with some weird settings and stuff there is a slight chance you might actually be safer than that tech guy who made sure to set it all up right which is not usually how this stuff works. Also, it appears that this problem can be patched and it is known exactly how it must be patched so you can just get updates for your router and other devices to fix it. The only problem with that is most router manufacturers seem to stop updating their routers a few months before they release them. It will be seen how this one plays out as there are always devices that don’t get needed updates because they aren’t supported anymore.

For more info check out Brian’s blog:

Fortunately this article isn’t talking about another hack but it is a story about a direct response to the whole Equifax debacle. This story is from a more general news site www.recode.net than I would normally get an article from for the blog but it was an interesting article.

   This week there has been more activity in the credit-reporting industry but it is from one of the other few businesses by the name of TransUnion rather than Equifax. The deal here is that TransUnion has seen the events unfold with Equifax and all the outrage towards them. They also see that there may be strict litigation to force them to prevent similar events from happening. This doesn’t sound too bad but it could make TransUnion’s life hard as a company trying to fulfil whatever rules are passed into law. This is why they have enlisted the services of a bunch of lobbyists to try to seemingly prevent any laws from being passed that would make them have to change anything they are doing. This may make things easier for them, granted they don’t get hacked themselves, but it doesn’t look very good on their part trying to prevent changes rather than embracing what security changes may be helpful in the future and showing the public that they are themselves better than Equifax has shown themselves to be. It isn’t anything on the same level of poorly dealing with the situation as Equifax but it isn’t a great first impression to the greater public eye that could use some hope in the other credit-reporting companies.

   This week’s article comes from Thomson Reuters website. Thomson Reuters is a different kind of company that collects information and statistics on people and money and all sorts of things to help other businesses understand parts of the world and make decisions like with marketing and stuff. While this is vague, so is the nearly nonexistent description of what they do. Collecting all of this information has a nice advantage, they can write well informed articles on a variety of topics that are more insightful than some. That’s exactly what they’ve done. On their site here: https://innovation.thomsonreuters.com/en.html

  I’ve heard over the years that macs are so much better in terms of security than windows machines but is this really true? It appears not! There was recently found some vulnerabilities in a lot of mac computer’s firmware that would let a variety of hacks be performed on these machines. It also appears that Apple itself has made the matter an issue in the first place while trying to make their firmware better which is rather ironic. You can read more in the article.

   This week’s article is from the site https://www.pcper.com/. They generally keep people informed of the latest advancements in computer technology and a plethora of hardware reviews. They don’t normally have a lot of security related stuff but this week I’m writing about one of the few recent ones they wrote.

   Two factor authentication is a very good thing, it helps secure your accounts on sites and stuff even if someone gets or guesses your password. The most basic and often adopted exclusively or before other types of 2FA are SMS one time codes. While it is better than nothing to get a text with a one use security code it is far from a good way to secure your accounts. If a hacker gets ahold of your phone permanently or even just at the time a code is sent they will be able to see the text notification with the code in it. Regardless of the vulnerability mentioned in the article (which I believe only adds to the real problem), the more pressing issue is that sites and accounts set up with only the option of SMS 2FA will do you little to no extra good security-wise but instead people should be looking to authentication apps like google authenticator for fully useful and secure methods of authenticating their accounts a second way.

   The site this week is CNET. It is a long standing technology site known for their reviews and software downloads. Apparently, they also have some tech news articles to like the one below about the most recent Equifax news after the really bad hack.

   Things just keep getting worse with Equifax. Just recently after the breach becoming public knowledge, Equifax’s website was found to be vulnerable to cross-site scripting. This means that someone with the right knowledge could set up spoofs that would collect people’s information with it looking like they are just entering in information on the site to monitor their credit after the hack. This is another bullet in Equifax’s diminishing reputation. Unfortunately, this may be almost as bad a problem as the original hack due to the amount of people who would be using this site to check if they may have been compromised by the first hack compromising themselves with this second problem. For now, People should just call Equifax for this information rather than use their problematic site so as to not ensure their being compromised.

   This article is from arsTechnica. At the beginning of the month, The FCC was found to have a bug in its comment system API that allows users to add files, pictures, or anything else they would like to upload to the FCC’s site (yes literally anything can be uploaded) given that it does not exceed 25MB in size. While this can be used in a non-malicious manner, it can also be used to upload malware or official looking documents for phishing. 

   This problem looks to have multiple parties to blame. There is firstly the API’s programmer who if they had just limited the kinds of file types or put some other kind of limits on the API could have nipped this one in the bud. The FCC’s web team or person also gets some flack for failing to properly screen commenting APIs before implementing one in which case they should have been able to implement limitations to make up for the API’s lack of them.

    Both parties,   The API’s developer(s) and the FCC’s web developers I believe both failed to do their jobs properly but now that this issue has managed to slip past everyone who should have caught it and been discovered and publicized, the biggest thing is what the FCC’s response will be and how fast they are to take care of the problem. Mistakes will always happen, that is a given, but if they are not addressed well and in a timely manner is when they can get to be a REALLY big problem. 

   The last thing to note is that because people can be uploading anything they want, you should be very careful not to click on files and other things on websites unless you know what the document, link, or whatever else it may be is.

   This week’s site is Bleeping Computer (https://www.bleepingcomputer.com/). It is a primarily computer security news website that also has some reviews and stuff on the side. From what I’ve seen they do a very good job at reporting the latest infosec news and I would highly recommend them.

   Today however, we are looking specifically at an issue in one of Bleeping Computers’ articles called the ROPEMAKER Exploit (or Remotely Originated Post-delivery Email Manipulation Attacks Keeping Email Risky). This exploit uses lines of CSS code in an email that would normally be fine and allows the sender to remotely change the CSS code. This exploit appears to be something similar to a zero day sort of threat, but not nearly so big as one, because it has been widely know about now for over a week and it hasn’t been seen being used “in the wild”. It is nice to know that there are some kinds of email providers that aren’t affected by it. Even though it isn’t an active threat yet, it could become so and so email providers need to make sure their systems are patched to prevent anybody seeing this become a larger issue. 

   Unfortunately the fact that this hasn’t turned into a larger problem yet means that most email providers will probably set their priorities on more present issues than working on a solution to this problem which is a shame because it could eventually become a big problem that was easily enough avoidable.

   For anyone who would like to see the original article, here it is for your viewing enjoyment:

   This week we are talking about hiding your DNS from your ISP. You pretty much need a VPN if you are going to be doing this. What is a DNS? you may ask. Well, DNS stands for Domain Name Server. It is the place your computer pings with a textual web address to get the actual IP from with all of the records of site names and IP addresses. People’s computers default to using their ISP’s DNS servers letting them know everywhere you have been online. This is very far from a private system as your ISP may very likely be selling that information to people even if they claim they make it anonymized data so it’s not directly linked to you. Again, they simply claim to do that which doesn’t mean they actually make it anonymous. Some VPNs can fail to connect you to their own DNS and leave you still using the default ones. This is called a DNS leak.

Cool Site Samples:

https://www.dnsleaktest.com/