SSCC 113 – Another Android hole, Tumblr forgets encryption, Nintendo under attack [PODCAST]

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

News, opinion, advice and research: Chet and Duck (Chester Wisniewski and Paul Ducklin) bring you their unique and entertaining combination of all four in their regular quarter-hour programme.

Chester's been on the road, so this epsiode of the Chet Chat is a couple of days late for logistical reasons.

We apologise for that, but Chet and Duck think it's no less interesting nevertheless!

In fact, this week's main story - the two-in-a-row exploits against Android code verification - intrigued your presenters so much that they resolved to link up and record this show, come what may.

And so, here it is: SSCC Episode #113.

(You can keep up with our podcasts via RSS or iTunes, and catch up on previous Chet Chats and other Sophos podcasts by browsing our podcast archive.)

The news wires have been buzzing with the "master keys" attack, and the "extra field" attack, both of which let you create Android Package files (APKs) that show one set of content to Google's cryptographic verification, and another to the installer.

Chet and Duck explain what happened, come up with some ideas that would have avoided the problem in the first place, explain what to do about it, and wonder how long before the fixes are on your handset.

From Android to iOS, where Tumblr published a version of its app that somehow managed to leave out the part that encrypts your PII before sending it over the internet.

Chet wonders how the average user is supposed to spot that sort of bug.

Nintendo got pounded by crackers who mounted a month-long password guessing attack.

The crooks only got hold of 24,000 passwords as a result (only!), and it looks as though those successes were largely down to using dictionaries of usernames and passwords from earlier hacks.

What to do? Federated identity? Password managers? A slimmer digital lifestyle?

Chet and Duck discuss the pros and cons of various ways to address the problem of password re-use.

And Chet's going to be at BlackHat 2013, and at DEF CON, so be sure to look him up in Vegas and say, "Hi."

Duck won't be there in body but you will find him present in mind and spirit, as he's putting together a special #sophospuzzle for the occasion.

The puzzle will go up on Naked Security, so everyone can have a go, but BlackHatters can enter at Sophos's booth at the trade show and win a secret prize!

(It's a cool secret prize, which Duck lets slip in the podcast, and Chester bemoans being ineligible to win.)

Don't forget: for a regular Chet Chat fix, follow us via RSS or on iTunes.

Follow @NakedSecurity

Follow @duckblog

Tags: #sophospuzzle, Android, Blackhat, DEF CON, Defcon, Encryption, extra field, firesheep, Google, hole, https, master keys, Nintendo, password reuse, Tumblr

View the original article here

Child abuse photo collector forgets to encrypt his USB stick - Bad security is a good thing

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Sometimes some good can come from poor computer security.

The Burton Mail reports that a 46-year-old British man was found guilty of downloading indecent images of children after he accidentally shared his USB memory stick with a work colleague.

According to reports, Nicholas Hill, of Belvoir Crescent, Newhall, handed a memory stick to a female colleague in order to get a recording of a TV programme, but as soon as his workmate plugged the USB drive into her computer she was shocked to be presented with an array of indecent photos.

Clearly, Hill had not encrypted the data on his USB flash drive.

When police were called they found "279 images in the mildest category and six which were slightly more serious" contained on the memory stick.

Hill's defence team said that he had been collecting such images for a number of years, and told a hearing at Derby Magistrates' Court that their client deeply regretted committing the offence, and was previously a "man of good character".

Presiding magistrate Jill Steiner put Hill on probation for three years, and ordered him to attend a community sex offenders' group work programme. If Hill buys computer equipment in future, he must allow it to be inspected by police officers - although he has said that he will access the net only from a public library in future.

Aside from serving probation, Hill has also been ordered to pay £85 costs. As he is currently between jobs, it was has been agreed that he can pay the fine in monthly installments.

Being a consumer of child abuse imagery only encourages others to supply more, and ultimately abuse the young innocent victims. Hopefully Hill will rebuild his life, and not engage in child abuse material again.

If that's the case then some small good will have come out of poor security.

Follow @gcluley

USB flash memory drive image from Shutterstock.

View the original article here