I am finishing up this semester so my blog too will be closing as well. As a result of this I wanted to look back at the past 12 weeks and reflect on what I have wrote about and why I chose the articles I did. Most of my articles had something to do with cyber criminals stealing information from consumers. I think the reason for this is most consumers are simply innocent victims. Even when larger companies are attacked like, Target the consumer is the one that pays the ultimate price. Sure Target sales might decline some, but they are big enough to rebound from such an event. The individual consumer might not be so lucky if their identity is stolen.

Hopefully this blog has generated some type of awareness to the few individuals that have read it. If it has then I am fine with it. I know hundreds of thousands of people like to express their views online. Maybe its because they are searching for validation, they are overly arrogant, or perhaps they don't have another way to share their ideas. Writing this blog was difficult for me because I am a somewhat private person. Once something is posted on line it is out there forever. Minds and opinions change that's why I don't think people should be putting personal ideas and thoughts on line. This is why I don't have a Facebook, Twitter, or some other social media account.

Let me close by saying keep your personal information safe.

Thanks,
Danny

A few weeks ago I posted on how iPhones and iPads operating systems were vulnerable to attack. Historically Apple provides very little information when it comes to revealing security issues, but company officials did say, "privileged network position could capture or modify data in sessions protected by SSL/TLS." In their effort to address this situation Apple restored the missing validation steps.

The flaw didn't allow attackers to compromise the device  but it made it possible to exploit the device through Man in the Middle attacks. This makes it possible for attackers to spy on user connections when a person connects via untrusted network. Even users on encrypted networks are vulnerable.

Apple users should update their iOS as soon as possible. The new update iOS 7.0.6 is available for iPhones, iPads, and iPods. For older generation devices like the iPhone 3GS and 4th generation iPod udate iOS 6.1.6 is available.

To find out more and to link to some of the updates visit Mike Lennon's blog Apple Fixes Dangerous SSL Authentication Flaw in iOS
  

In keeping with the spirit of the Olympic games I am dedicating this post to the games. The Olympics are supposed to be a time of year when nations put aside their differences and humanity comes together to celebrate what we all have in common. Unfortunately these games have been plagued with news of security vulnerabilities and possible danger to Sochi visitors. These threats aren't limited to physical security either. 

US officials have warned travelers to this years games that they should not expect any level of privacy. Not all of the threats are coming from internet criminals. Other entities that maybe trying to view personal information include state surveillance and hacker attacks. In previous games held in London and Beijing some controls were put in place to help provide at least some level of privacy to internet users during the games. Russia however allows for complete government inspection of any digital communications. In other words Russian officials can legally block or intercept any communications sent over land lines, cell phones, or the internet. All of the information collected is then stored and analyzed as needed. US security analysts have gone as far to say when travelers connect to hotel networks or encrypted private networks they should assume these have been compromised as well, and only transmit data to known trusted sites.

Sochi visitors are encouraged to buy pre-paid cell phones while on vacation and only call the few numbers you need. They should also keep in mind their conversations are being monitored. They won't enjoy the same freedoms we do in the United States so they will need to monitor what they are personally saying to help avoid any possible trouble. If travelers brought their laptops with them it is recommended they turn them off during their stay and get a security professional to check them out once they get home.

It's a sad day when people can't go and support their country's athletes without being victimized in the host country. Even though the danger is there with some careful planning visitors can still show their patriotism and keep their personal data safe at the same time.

GO TEAM USA!!!!

You can read more about this here: http://www.csmonitor.com/World/Security-Watch/2014/0206/The-other-security-concern-at-Sochi-Olympics-cyberthreats

New Malware Could Record What You are Doing on Your IPhone

 

It appears one of the advantages the iPhone has over the Android phone market could be slipping away. Android has been taking a beating for the security risks it has because of the open access policies it has when allowing apps to be used on their phones. Traditionally iPhones have been fairly secure for users but there is a new  “screenlogging” malware that is raising some eyebrows.

Neal Hindocha is planning on demonstrating how this malware puts iPhone users at risk at the RSA Conference in San Francisco. Screenlogging is similar to key logging with the main difference being instead of logging key strokes it logs the swipe of your finger on the screen while taking screen shots at the same time.

Sifting through all of that information would be very labor intrusive on the would be hacker, but the malware can be designed to only work with certain apps. By doing so the information stolen can be targeted to things like banking app credentials or VPN log in credentials to lessen the amount of data that needed to be analyzed.

Hindocha hopes that releasing his research will bring attention to the threat and some solutions can be applied to this risk.  Most Apple users don’t have a lot to fear at the moment though. Apple’s present security holds up against the attacks unless you have been foolish enough to jail break your phone or iPad.

 

If you want to read more on this topic check out this site. New Malware Records Everything You Do on Your iPhone

Well its Sunday night so, it must be time for my latest blog. I'm battling the flu right now so hopefully I still make sense. I'm hopped up on medicine, have a fever of 102 degrees, and am seeing double. This should be interesting to say the least. Haha!!

Well this week I am going to discuss a bug found on Facebook. A computer engineer in Brazil, Reginaldo Silva, posted his findings to Facebook last November. The bug allows users to centralize their authentication process so multiple log ins aren't necessary. For his work Facebook rewarded him with a $33,500 check. Not to shabby.

At first Reginaldo thought his finding was an isolated incident and didn't putt much stock into his findings. He reported the bug to Google and was rewarded $500. He thought that as the end of it until  year later when he began to suspect Facebook was vulnerable. The bug was difficult to ind and recreate because a large number of things need to occur. Once he discovered the code he was easily able to recreate the finding.

Once inside Reginaldo was able to access and read almost any file that passed through the Facebook servers. Once the bug was reported Facebook claims to have had a temporary fix in place in 3.5 hours. Obviously Facebook was grateful for Reginaldo brought this matter to their attention. According to Facebook the $35,000 pay out was the largest ever paid by them.

For more information on this check out the following site.

Facebook Payout

HealthCare.gov is making me sick

I have never been a big supporter of ObamaCare because I feel it harms more Americans than it helps. It not only limits the amount of coverage you can get it is causing insurance rates to soar because the subsidies it offers are almost impossible to qualify for. The website designed to make signing up for insurance is one of the greatest disasters of the program. Not only is it making hard for people to sign up it is a hackers dream site. With its poor security standards some IT security experts are calling it "a breach waiting to happen."

David Kennedy, CEO of TrustedSec is testifying in front of Congress about the dangers related to HealthCare.gov. This is his second time in front of Congress talking about the same subject. Last year a number of vulnerabilities were identified and as of today only have of them have been fixed. If that isn't bad enough 20 additional vulnerabilities have been discovered. The only good news for the website is Kennedy formed his opinion based on his experiences working with other companies, and not through an actual hacking attempt.

This doesn't give the website a free pass though. Kennedy asked 7 other IT security professionals to review how work and provide their opinions. "The results were unanimous and unified--it's bad."healthcare.gov-security-a-breach-waiting-to-happen/ Other statements ranged from "I can tell you: this is a breach waiting to happen" to "perhaps a breach already has happened."

Some reasons for the lack of security has been blamed on poor security testing, training, and not following basic IT change management practices.

The security experts are recommending a comprehensive security assessment of the entire website. The assessment is needed to identify where resources need to focused. Of course the website developers have a team trying to counter these revelations. Their main advocate is Lunarline CEO Waylon Krush. Krush who has worked in security roles for the Department of Health and Human Services questions Kennedy's findings even though he has admittedly not reviewed them personally.

Man this really boosts my confidence! This whole undertaking is proving to be another colossal waste of taxpayer money by another subpar administration. It's time to throw the towel in on this fiasco.


http://news.cnet.com/8301-1009_3-57617335-83/healthcare.gov-security-a-breach-waiting-to-happen/

Payback for some Eastern European Hackers

Well it seems that there truly is no honor among thieves. A group of cyber criminals stole the personal information and log in credentials of a rival group of Eastern European cyber criminals. Yeah for us good guys, for once we weren't victimized!!

According to IntelCrawler, a leading security firm, the victims were members of "Verified", one of the largest online forums in Eastern Europe. Most of the information on the forums focused on how to commit bank fraud in countries like the United States, United Kingdom, and Australia.

It is believed the attack is the result of a group of administrators from a rival crime forum and proves cyber criminals are just as vulnerable to attack as the rest of us.

The attack worked by exploiting a PHP vulnerability in CNStats STD 4.3, a web application used to monitor traffic. The breach made it easy for the cyber criminals to access material dated as far back as 2011. Attackers also gained access to the MySQL database that contained user login information for more than 18,894 criminals. Hopefully law enforcement will be able to take advantage of this and make some arrests.

Even if a wide spread crackdown never materializes we can still benefit from this attack (and perhaps get a little joy out of it). This attack enforces the idea of staying current on software patching. If patches aren't available for the software you are currently using I would suggest looking into replacing it. If hackers are willing to turn on each other you know they won't think twice about going after us.

For more information on this story check out Fahmida Y. Rashid's article Hacked Cybercrime Forum Exposes Nearly 20,000 "Bad Actors" . The link is listed below.

http://www.securityweek.com/hacked-cybercrime-forum-exposes-nearly-20000-bad-actors