Platform would protect smartphones from cyber criminals

Criminals don't have to pick your pocket to get what they want out of your mobile. But a certifiably secure operating platform is being developed by Swedish researchers so that consumers can be confident that their mobile data is safe.

Market analysts expect the next decade to see a significant expansion in the numbers of connected devices and machines.

But increased connectivity also presents an opportunity for criminals. Mads Dam, an expert in computer security at Stockholm's KTH Royal Institute of Technology, says that devices and modules will be exposed to increasingly sophisticated attacks by cyber criminals.

"People are going to place even higher value on products with verifiable security claims," says Dam, who is Professor of Teleinformatics at KTH's School of Computer Science and Communication.

While compact in size, mobile phones pose a huge security challenge, Dam says. "Android, for example, has more than 10 million lines of code and is executing on a computing platform with one billion transistors.

"So it's not surprising that securing this kind of system is difficult," Dam says. "The good news is that an end-to-end security guarantee is within reach."

Dam and his colleagues aim to publish a certifiably secure, trusted execution platform for operating systems. The idea is to outwit malware and other attacks on a device with a layer of software called a "hypervisor," which is designed to secure the interaction between the operating system (OS) and the hardware.

"If the operating system asks for the camera to be turned on, the hypervisor can step in and verify whether that is really what the user wants," he says. "Or if the operating system wants to access a piece of memory that normally should be regarded as secure, it could step in and allow, or disallow, the request."

In fact, Dam says, a hypervisor-based solution could completely isolate different apps from each other, to create truly tamper-proof applications, for instance for banking or communication.

Such a platform could be made much smaller than the OS itself, he says. "We're talking about a factor of 1,000 to 10,000, which is sufficient to create mathematical models that can analyse the security of interaction between the OS and the hardware so well that we can formally guarantee the security of an operating system like Linux."

And it's not just mobile users that will benefit. In addition to mobile communications networks, the platform would be applicable in a wide range of areas including control systems for manufacturing plants, power stations, utilities and infrastructure. Other uses would be in vehicles, avionics and medical systems, cloud application platforms and also for devices in the internet of things.

The project partners, which include the Swedish Institute of Computer Science (SICS), propose publishing key components of the hypervisor as open source, in order to increase trust and allow de facto industry standardization of the security platform.

Dam says it will require more than a secure execution platform to secure devices from end-to-end, that is, from the user interface through the software stack, down to bits of silicon and back. Hardware and application platforms will have to be validated too. But the KTH team has made great progress during the last decade on tracing security from the application and user interface to the execution platform and back, he says, and the hypervisor will be a vital tool to achieve this.

"Soon we will be able to engage industry and organisations with serious security concerns, like banks, public organisations, defence and providers, and develop this space."

Cite This Page:

KTH The Royal Institute of Technology. "Platform would protect smartphones from cyber criminals." ScienceDaily. ScienceDaily, 5 March 2014. .KTH The Royal Institute of Technology. (2014, March 5). Platform would protect smartphones from cyber criminals. ScienceDaily. Retrieved May 5, 2014 from www.sciencedaily.com/releases/2014/03/140305125102.htmKTH The Royal Institute of Technology. "Platform would protect smartphones from cyber criminals." ScienceDaily. www.sciencedaily.com/releases/2014/03/140305125102.htm (accessed May 5, 2014).

View the original article here

Twitter hacked, at least 250,000 users affected: what you can do to protect yourself

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Ouch. Hyperpopular microblog-type-thing Twitter is the latest web property to admit that intruders seem to have been wandering around its network for some time.

Earlier this week, both the New York Times and the Wall Street Journal came out with similar revelations.

With an irony that even the most literal-minded reader is unlikely to miss, Twitter published a blog post entitled Keeping our users secure:

This week, we detected unusual access patterns that led to us identifying unauthorized access attempts to Twitter user data. We discovered one live attack and were able to shut it down in process moments later. However, our investigation has thus far indicated that the attackers may have had access to limited user information – usernames, email addresses, session tokens and encrypted/salted versions of passwords – for approximately 250,000 users.

The article goes on to say that the company has "reset passwords and revoked session tokens" for the accounts that it thinks were affected.

A session token is a one-off cryptographic cookie that your browser submits to Twitter every time you revisit the site once you've logged in, so you don't need to enter your username and password over and over again.

A crook who steals your salted-and-hashed password can make educated, offline guesses at your password by trying out popular passwords (at great speed on modern password cracking kit), but if you have chosen a decent password, will probably get nowhere.

On the other hand, a crook who steals your session token can, in theory, take over your account, at least until he or you next log off.

By revoking your token unilaterally, Twitter will cause only minor annoyance to you (you will have to type in your password again) but create a major headache for any session hijacker (who will, if you have chosen well, be unable to enter your password to get back in).

Twitter also links to advice on how to turn off Java in your browser, but doesn't actually say whether the activation of Java in your browser had anything to do with the breaking to Twitter's network.

A client-side vulnerability on a Twitter administrator's computer might produce such an outcome, as happened when a Twitter staffer chose a shabby password a few years ago, but it's difficult to see how vulnerabilities on your client could lead to a server-side database compromise at Twitter.

We also echo the advisory from the U.S. Department of Homeland Security and security experts to encourage users to disable Java on their computers in their browsers.

Seems that Twitter took against the whole of Java at first, then scaled back its advice to suggest that you kick it out of your browser only, not that you uninstall it altogether. That matches the advice Chester and I gave in our recent podcast. Our Java discussion can be found at 4'50":

Still a raft of unanswered questions here.

How did they get in? Why undetected for so long? Who were they? What else did they get? Are users beyond the initial 250,000 affected? And so forth.

Twitter's being pretty open about this, and investigation continues, so my inclination is to take the company's comments and advice at face value.

If you were using your Twitter password anywhere else...you know what to do. Change the other passwords and don't do that again.If you're using short or easily-guessed passwords, change them and don't do that again.If you have Java on in your browser and you aren't already 100% certain you need it, turn it off.Don't stay logged in to services like Twitter when you aren't actively using them. That makes it less likely that your session will be hijacked. It also means you won't forget you're logged in and click/like/post/approve something you didn't really intend to.

The above precautions would have protected you proactively, even if you were one of the users whose data was spilled by Twitter.

Longer, complex passwords are harder to crack from their hashes; regular logouts mean your session cookies are valid for shorter periods.

Further reading: Questions and answers about the Twitter hack.

Follow @duckblog

View the original article here

42% of lost mobiles have no security in place to protect data, says report

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

If the UK is any indication, we're letting our precious mobile devices drop from our bags and pockets, scattering our unprotected data throughout the land at an alarming rate.

Surveying 1,008 UK consumers between the ages of 16 and 64, Sophos found that 42 percent of devices that were lost or left in insecure locations had no active security measures to protect data.

More findings from the survey, which was part of a wider awareness campaign regarding mobile device security:

20% of lost devices had access to work email, potentially exposing confidential corporate information. 20% contained sensitive personal information such as national insurance numbers, addresses and dates of birth.Over 10% contained payment information such as credit card numbers and PINs. 35% had access to social networking accounts via apps or web browser-stored cookies.

Sophos's James Lyne notes that the lack of awareness around data security among the general public is inevitably going to lead to BYOD-induced holes poked into corporate security:

"Indeed, the research already shows that corporate email - on lost and potentially unsecured devices - opens up a potential security hole in the infrastructure. This lack of precaution and awareness risks putting businesses in the firing line when it comes to complying with data privacy legislation and protecting sensitive information."

The survey also produced some interesting findings regarding how likely we are to lose devices depending on our gender, age, and whether or not we live in London, where people evidently seem to drop gadgets like hot potatoes.

In a nutshell, if you're a young, male Londoner, you've practically got an allergy to cell phones, tablets and the like. The findings:

38% of men had lost devices. But don't feel bad, o ye multi-chromosomed ones. You tend to secure yours better, given that...66% of men had security measures in place. 33% of women, on the other hand, had lost a device, but only ...49% of women claimed to have had security in place.50% of Londoners had lost a device, compared with... 36% throughout the nation. But again, don't feel too bad about that, given that Londoners are more inclined to security, with...66% of Londoners having secured their devices, compared with only...58% of UK citizens overall who claim to have secured their gadgets.

The survey also found that young people do not get along particularly well with gadget retention, but they're smarter than their elders when it comes to securing the mobile devices they lose.

The findings:

People between the ages of 16 and 24 were over four times more likely to lose an electronic device compared to those aged between 55-64. 59 percent of the older age group had no security precautions, compared to ...45 percent of 16- to 24-year-olds who didn't secure their toys.

That's all well and good. It shows that younger people are learning lessons about how to protect their data.

But, Lyne pointed out, the numbers still show a sizable chunk of people who haven't learned the lesson:

"Those with protection are still too low and as we begin to rely on and invest more in our electronic devices, there needs to be a shift across the board in the attitude and education surrounding mobile, laptop and tablet security."

Other survey findings:

36 percent of those surveyed had lost an electronic device in public at some stage.Of those who had lost an electronic device, 78 percent had lost a mobile phone, laptop or tablet.58 percent of those surveyed were never able to recover the lost device.One-fifth got the device back within 24 hours, but... The return rate dropped significantly after 24 hours.

These findings point to a lot of data getting lost, and that points to a huge potential for security holes, as Lyne said.

Education of the masses is key, but businesses also have to get their BYOD policies in order, he said:

"Businesses … should ensure their traditional IT security educational policies extend to laptops and mobile devices. Otherwise they are spending significant amounts of time and money securing data in one part of their infrastructure only to allow the same information to walk out of their building on an unsecured employee device."

Sophos has tips for businesses on how to secure devices and offers this free mobile security toolkit.

On an individual level, the loss of a device promises the forfeiture of personal data (such as photos and contact information).

It also often carries the risk of personally identifiable information that can lead to thieves plundering bank accounts and credit card accounts and/or hijacking social media accounts, not to mention the cost of the device itself.

Follow @LisaVaas
Follow @NakedSecurity

Worried man, dropped phone and passcode on phone images courtesy of Shutterstock

View the original article here

Google staffs up 'Red Team' to protect the world from its privacy lapses

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

After agreeing earlier in the month to cough up a record $22.5 million in a settlement with the Federal Trade Commission for sneaking tracking cookies past Safari browsers' no-tracking controls, Google is creating a privacy "Red Team" to police its products' own privacy bugs and dangers.

The settlement is over Google's override of the cookie controls in Apple's Safari browser.

As the FTC explained, Google snuck around those controls by creating an invisible HTML form and then using JavaScript to pretend a user had submitted it.

Google thereby bypassed the browser's blocking of third-party cookies - i.e., those set by sites other than the ones a user originally visits.

The form was invisible and lacked either content or a Submit button, meaning the user could never have actually submitted it.

But Safari, duped into thinking the user had submitted a form, then allowed Google to place a DoubleClick cookie on the user's computer.

The FTC cried foul, charging Google with misrepresenting its use of tracking cookies and of breaking its privacy promises.

Now, Google's hiring a ninja - pardon me, make that a "back-end ninja" - to slap itself into privacy shape.

Specifically, a recently posted job listing advertises for a Data Privacy Engineer to join its team of privacy "back-end ninjas".

The task of the Google back-end ninja:

As a Data Privacy Engineer at Google you will help ensure that our products are designed to the highest standards and are operated in a manner that protects the privacy of our users. Specifically, you will work as member of our Privacy Red Team to independently identify, research, and help resolve potential privacy risks across all of our products, services, and business processes in place today.

Red teams are nothing new: the term refers to an independent group that serves to challenge an organization to keep it on its toes.

Penetration-testing is on Google's wish list, so the search empire is obviously planning to kick its own privacy tires.

The responsibilities are to:

Analyze software and services from a privacy perspective, ensuring they are in line with Google's stated privacy policies, practices, and the expectations of our users.

That sounds, actually, like whoever assumes the role will function as something of an ombudsman, watching out for the constituent interests of the user base.

Google to date hasn't done much to earn users' trust that even a large-ish fine will stop it from pulling egregious privacy shenanigans.

When Sophos's Paul Ducklin polled users, over 90% said that no, financial penalties are certainly not enough to make the online behemoths play ball on privacy.

Well, hiring a privacy red team certainly sounds like Google's on the road to improving a situation that led to its slipping ghost forms, cookies and ads past the blocks on users' browsers.

This time, let's hope Google's privacy promises aren't as empty as that Safari-bamboozling, empty HTML form.

Follow @LisaVaas

Privacy image from Shutterstock.

Tags: browsers, Data Privacy Engineer, DoubleClick, Federal Trade Commission, fine, ftc, Google, job listing, Red Team, Safari, settlement

View the original article here