#ics484

   Among other recent flack on large companies, Intel is another one on the list. It has been found that Intel’s management engine on their last three generations of processors has multiple security flaws. It does appear that someone would need at least network access to your pc to exploit one of these processors but as of yet the full extent of the problem is not known.

   If you have been watching the news lately you may have heard mention of another big hack this time on the company Uber. Uber fessed up to having kept a hack of data from 57 million of their user’s accounts secret for the last year. Uber made a statement that they know they should have said something about it earlier but didn’t. The fact that they kept this from the public, from people who were affected by it and had the right to know their information was in danger will put a very large trust barrier between them, and their customers and even drivers.

   Google, one of the bigger tech companies with their fingers in just about every pie has been up to some shady stuff. It was recently admitted by Google that they are tracking your phone, that is, even if you’ve turned off tracking settings and don’t have a sim card. While this invasion of privacy is and was a thing, google said they will be discontinuing this cell tower tracking method saying that it was a part of a never completed project. With super corporations like Amazon and Google it is probably safer to be on the skeptical side of things but we will see if they hold true to this promise.

A trend has started in the Cyber Security world, a trend for finding skilled qualified talent. It is becoming a more common thing for businesses to sponsor cyber security competitions based on possible scenarios presented more in the form of a game. This is however more than just a smart recruitment method, it is also a way to inspire young people to pursue careers in cyber security. There is a gap in this field with somewhere around a million jobs that are just waiting to be filled. It’s not just STEM that is needed, there is a security gap that is important to fill and I believe this competition trend is a start in the right direction.

   Here is a cool thing going on in the tech security world. Shannon Morse of hak5 (the people who make the wifi pineapple and other pen-testing tools) is making a short video every day for a month on how to make yourself more secure digitally. There are different topics each day made simple enough for most anyone to follow along to. That’s what makes this so good. It is good for those who have a strong computer background as they should be able to find one or two videos to educate them on security. It is also great for those who aren’t very computer savvy though they shouldn’t be completely computer illiterate. Each video is around five minutes long making each of them an easy watch and a small time commitment. You might want to wait for most of the rest of the videos as this started on November 1st and will be going on for thirty days total. So share this with anyone you think could really use it or share a part of it. The weakest link in cyber security is usually people and generally the ones who don’t know much about computer security, but if everyone who does know makes an effort to teach everyone who doesn’t, we should end up with a lot of much safer people and businesses.

Very recently a British citizen found a usb flash drive on the ground and decided to plug it into a library computer. This man had found the unencrypted documentation of all the security and blueprints of Heathrow Airport, Britain’s largest airport. The blueprints were not just the regular stuff like the terminals and the bathrooms, these had camera locations, tunnels used by dignitaries, and even routes used by the royal family. To say he stumbled upon some sensitive info would be an understatement. Due to the details of the blueprints and the fact they were just lying on the ground somewhere an investigation has been opened. The thought that someone in the airport could have been trying to sell the plans to a terror group or anything remotely similar are all still possibilities and not nice ones. For more info see the article below.

   Google very recently released a new feature with Google accounts that you can choose to turn on. The feature is called “Advanced Protection Program” and if you are willing to opt into it, it will up your security game keeping you much safer than using the current security settings. 

   The new settings implement a form of two factor authentication where you must have a physical key in addition to your password making it harder to hack unless someone gets physical access to your key and can crack your password. This form of 2FA is is far more secure than getting a code by text and somewhat better than an authenticator application.

   In addition to forcing this more secure authentication, this security setting makes it harder for just anyone to reset your password through email which is an method used by hackers to get control of people’s accounts.

   In the current article for the week is a story about a new exploit in Microsoft Word. Many people have heard of the ability to execute malicious code stored right in an MS Word document which was a big problem in the past seemingly from a design flaw in the file type or something of the like if I remember correctly. That actually got word document format files outlawed in space (namely the ISS). But as I said, that was awhile ago. Rather recently however, a new exploit just about as bad as the first has come to light. 

   This exploit is built off of an unsuspecting feature in word called DDE or  Dynamic Data Exchange. It allows programs to send information to each other and doesn’t get picked up by antimalware. It has been shown to have been used in the wild but only so far for very major high-profile attacks as far as I can tell. 

   Though this is a very bad thing there is fortunately a fairly easy way to guard against it. It just involves turning off a feature in word’s settings and is described with some good pictures in thehackernews’s article linked below. If you just use common sense and don’t open unknown or trusted word documents you should be fine but to be on the safe side turn off that setting too.