Talking Angela iPhone app scare spreads on Facebook

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

A bogus warning is spreading across Facebook, telling parents of young children to watch out for a rogue iPhone/iPad app that (the warning claims) steals children's names, details of where they go to school, and even takes secret pictures of their faces.

The chain letter warning about the "Talking Angela" iOS app is being unwittingly spread by Facebook users, presumably with the thinking of "better safe than sorry" rather than "maybe I should just check the facts before forwarding this scare onto my friends".

The truth is that "Talking Angela" appears to be entirely benign, and there are no obvious privacy concerns that differentiate it from thousands of other iPhone apps.

Indeed, the "Talking Angela" app is no different from other similar popular children's apps from reputable iOS developer Out Fit 7 Ltd, including "Talking Tom Cat", "Talking Ben the Dog" and "Talking Gina the Giraffe".

Here's what a typical warning looks like when it is spread on Facebook:

WARNING FOR TO ALL PARENTS WITH CHILDREN THAT HAVE ANY ELECTRONIC DEVICES , EX : IPOD,TABLETS ETC .... THERE IS A SITE CALLED TALKING ANGELA , THIS SITE ASKS KIDS QUESTIONS LIKE : THERE NAMES , WHERE THEY GO TO SCHOOL AND ALSO TAKE PICTURES OF THEIR FACES BY PUSHING A HEART ON THE BOTTOM LEFT CORNER WITHOUT ANY NOTICES . PLEASE CHECK YOUR CHILDREN'S IPODS AND ALL TO MAKE SURE THEY DO NOT HAVE THIS APP !!! PLEASE PASS THIS MESSAGE ON TO YOUR FRIENDS AND FAMILY MEMBERS THAT HAVE KIDS !!!!

The inference from the all-caps warning is clearly that "Talking Angela" is somehow a risk to children.

However, whoever started this scare has got their facts in a muddle.

For one thing, "Talking Angela" is an iOS app - not a website (although there is an optional Facebook component).

Also, the app's purpose is to wait until the child says something and then mimic what they say back to them (albeit in a Parisian feline fashion) rather than to pilfer details of where they go to school.

None of this, of course, is to say that you shouldn't be careful about what smartphone apps you install, and which Facebook applications you grant access to your social networking profile.

Furthermore, it's always a good idea to keep a close eye on what children are doing on the internet - in case they get themselves into a spot of bother.

But the warning spreading across Facebook appears to be nothing more than a scare - setting the cat amongst the pigeons unnecessarily.

Keep your wits about you and stay informed about the latest scams, hoaxes and malware attacks spreading fast across Facebook. Join the Naked Security from Sophos Facebook page, where more than 200,000 people regularly share information on the latest security issues.

Follow @gcluley

View the original article here

Security scare after airline boarding passes reveal how passengers will be screened

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Bruce Schneier's head might explode. The noted cryptographer and security Obi-Wan Kenobi has been a longtime critic of the US Transportation Security Administration (TSA) - accusing the agency of incompetence in the way it operates security screening at US airports.

Now come reports that the agency has been tipping its hand to would be terrorists by disclosing what kind of security screening passengers who use the TSA's Pre Check program will receive up to 24 hours before their flight.

The security lapse, first spotted by aviation bloggers, could give terrorists an easy way to slip through security check points with forbidden material without fear of getting caught.

Pre Check is a TSA program that allows frequent flyers on participating airlines to get expedited screening on domestic travel. There are separate screening lanes at airports, and Pre Check passengers don't have to do the hated TSA striptease: removing shoes, belt and outerwear, while disgorging the contents of their bags and pockets. It's all very civilized. But insecure.

The news about the chatty boarding passes percolated up from aviation blogs, such as Puckinflight, where travel enthusiasts noticed that flight information encoded in barcodes printed on Pre Check boarding passes wasn't encrypted.

Passengers could print out their boarding pass in advance, then scan the printed barcode to determine whether or not they would be screened at the airport.

As Puckinflight notes, the security lapse creates two problems. First: because the barcodes aren't encrypted, passengers can alter information on the front of the boarding pass. Second, passengers can actually change their Pre Check status, generate a new barcode and then digitally alter the boarding pass so that they won't get screened.

The story left experts scratching their head, including Schneier:

What a dumb way to design the system. It would be easier - and far more secure - if the boarding pass checker just randomly chose 10%...of PreCheck passengers to send through regular screening.

If the checks are random - as they should be - why assign them in advance, Schneier wondered.

This isn't the first time the TSA has found itself in hot water over insecure boarding passes.

In 2006, the security and privacy rights gadfly Christopher Soghoian got himself raided by the FBI after he created a boarding pass generator that would create fake boarding passes for Northwest Airlines. Despite the fact that he merely applied techniques that had long been public knowledge about how to create bogus passes, and exploiting obvious gaps in airport screening processes.

Security experts complain that the TSA uses separate systems to issue the boarding passes and to check passengers in, making it easy for anyone with a computer to digitally alter a legitimate boarding pass and board a plane.

The TSA addressed some of those concerns when it moved to use encrypted barcodes in 2009 - a move that made it harder to digitally manipulate legitimate boarding passes. But that begs the question of why the agency elected to use unencrypted barcodes for its Pre Check program.

Experts like Schneier also accuse the agency of putting too much emphasis on procedures that make a show of security - like shoe scanning, bag emptying and checking photo IDs - but that provide little real security, because they're noisy - too many false positives - or easy to circumvent.

Though embarrassing, the Pre Check boarding pass flaw is just one of many in a deeply flawed system, Schneier argued. He wrote:

I don't feel any less safe because of this vulnerability.

The TSA did not immediately comment for this story.

Follow @PaulFRoberts
Follow @NakedSecurity

Departures sign and boarding pass images courtesy of Shutterstock

Tags: airline safety, airline security, Airlines, barcode, boarding pass, Bruce Schneier, hacking, Pre Check Program, screening, terrorism, Transportation Security Administration, TSA

View the original article here

Wayward Instagram account creates security scare for Norwegian Royal family

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

The secret life of the Norwegian royal family has been on display for anyone with an Instagram account after the son of the country's Crown Princess was found to be over-sharing photos of family holidays and other events, according to media reports.

Marius Borg Høiby, the 15 year-old son of Crown Princess Mette-Marit, had been posting the photos on a personal Instagram account. The photos included GPS information that could reveal the location of the royals – a major security lapse.

Høiby is the son of Crown Princess Mette-Marit from a relationship prior to her marriage to Norwegian Crown Prince Haakon. He is the half brother of their two children: Princess Ingrid Alexandra and Prince Sverre Magnus, royal heirs to the Norwegian throne.

Høiby'a Instagram account was public for close to a year, with the teenager posting frequent photos of himself and his family on holiday and in other informal settings. The photos were also shared with Høiby’s Instagram contacts.

The teen shared 133 photos, including pictures of the family at the Royal Palace in Oslo and on vacation. He also divulged information on the family’s location and planned travel, according to reports.

The incident has caused a minor scandal in Norway, where the media and security officials were quick to declare it a dangerous breach that could have put the family’s physical security at risk. Fingers pointed at Norway's police intelligence unit, the Politiets sikkerhetstjeneste (PST), for failing to properly inform the family about the risks in social media.

That prompted Mette-Marit to write an open letter to VG editor Torry Pedersen Wednesday.

In it, she noted that the Instagram account had been removed, but questioned the media uproar over the leaked photos. The family’s movements and residences were a matter of public record, Mette-Marit argued, so Høiby's photos revealed little information that wasn’t already known.

But the incident has fed into an already simmering debate within Norway about what some see as the government’s lax attitudes about public safety. This, following the mass murder of 77 people in Oslo and the island of Utøya in July, 2011 by far-right nationalist and paranoid schizophrenic Anders Behring Breivik – an incident that continues to command headlines.

Geo-tagging is a common feature of most modern cameras, including cell phone cameras. The GPS coordinates in photos can be easily read and displayed using image editing tools or on photo-sharing sites like Flickr, which extract the GPS data from digital photos and map photos to their real world locations.

In a story published today, Naked Security contributor Paul Ducklin posted a photo of the daily specials board at an unnamed restaurant in his home town of Sydney, Australia. He challenged Naked Security readers to name the restaurant and give its address. In a matter of hours he had his answer – from Adrian in The Netherlands, who used an online photo processing tool to extract the location data.

The easy accessibility of location data poses a big problem for consumers and for security conscious organizations.

The US and British military have restrictions on the use of mobile phones in war zones. Earlier this year, the US Army warned about the dangers of geo-tagging by soldiers, as well.

Follow @paulfroberts

View the original article here

Strawberry Quick Meth scare spreads widely via Facebook

Over 100,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

For the last few days Naked Security has received enquiries from readers asking about a message that has been widely shared across Facebook.

Although the message isn't related to computer security issues, it seems to have raised enough concern that it feels appropriate to discuss it here.

The message, which is sometimes distributed with an image of what appears to be pink-coloured crystalized methamphetamine, claims that children are being targeted with drugs that taste of strawberries.

...There is a drug going around the schools ...It's known as Strawberry Quick ...or strawberry meth ...it looks like pop rocks that kids eat, smells like strawberries &... also comes in other flavors like chocolate, etc..... Please tell your children not to take candy from anyone even a classmate because this drug that looks like pop rocks is actually crystal meth rocked up with strawberry flavor & can kill them :'( ...PLEASE RE POST!!! So all parents are aware of this ......Thank You!

The Hoax Slayer website, however, points out that the messages are highly exaggerated and inaccurate and can be dated back as far as 2007.

So, if you are forwarding this message to your Facebook friends, you are perpetuating what seems to be a baseless scare rather than providing a useful warning.

Nonsense messages like this clog up social networks just like commercial spam, wasting time and hardly helping the signal:noise ratio.

Keep your wits about you and stay informed about the latest scams, hoaxes and malware attacks spreading fast across Facebook. One of the best ways to do that is to join the Sophos Facebook page, where more than 160,000 people regularly share information on threats and discuss the latest security news.

Follow @gcluley

View the original article here

Facebook's ticker privacy scare, and what you should do about it

Over 100,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Amongst the recent new changes to appear on Facebook, there is a "ticker" (a rolling real time list of what your friends are doing).

Not everyone has received it yet, because it's on a staggered rollout, but millions have already seen it.

You'll find it on the right hand side of your Facebook page, in the collapsible chat bar.

It's smashing if you want to keep fully up-to-date with your friends' activity, but there is a problem with it.

The ticker makes it very simple for you to eavesdrop when one of your Facebook friends says something to someone you've never heard of - and even see what the stranger originally wrote too.

Testing shows that your privacy settings are working the same as they did before, providing you used them in the first place.

The appalling enforced eavesdropping in the ticker (your friend said something to someone you've never heard of) is the result of the lax or non-existent settings of your friends, so here's the deal..  
What happens is this:

1. You have "friends of friends" or "public" as the privacy setting for your posts.
2. One of your Facebook friends comments on your post, or clicks "Like".
3. As well as all the people commenting on the thread seeing what has been posted (this much is normal), Facebook also tells all *their* friends what was said.
4. Your friend's settings *cannot* stop this from happening, *your* settings can protect your friends' privacy, in this instance.

The ticker has just made it much easier to eavesdrop on what were probably intended to be more private conversations.
So, do this - and make your friends do it too:

* Stop using the "Friends of friends" setting. This is what is broadcasting so widely.

* If you use the "Public" setting, explain that you are doing so. Then people can decide if they want *all* of their friends to be informed of their comments.

* "Limit" all previous posts you have made via the privacy settings (unless you had "friends only" or specific lists already) - this will change everything to "friends" only and will stop people you deleted but did not block, people who sent you friend requests that you ignored, and friends of friends from seeing your activity (yes they can, if you are not on "Friends" or lists).

* Use lists to decide who you want to see things (use the privacy controls in the top right of your posts).
* Encourage your friends to restrict their setting to "friends" or custom lists too. This is the important bit.

* Inform strangers or the connecting friend when strangers show up in your feed. It is their settings that made them show up. This will illustrate to them why they also need to change their settings.
It is not just your settings that control what goes in your Facebook newsfeed and appears on your friends' tickers. Anyone's posts which have privacy set to more than "Friends" will go to all the friends of all the commenters. This is a fact! We've tested it!

Still baffled?  Don't worry.  The problem is complicated to explain, but the solution is simple.  If you want to stop strangers from seeing everything you do, you and your friends need to change your privacy settings to "Friends" or custom lists.  That's it.

The hard part is getting your friends to do it.  
If you find your friends aren't understanding the issue, forget about explaining the details and "copy and paste" this to your status:

"If you don't want your actions broadcast to everyone via the ticker/News Feed please set your privacy to "Friends" and ask your friends to do the same.  Pass it on."

What *not* to tell your Facebook friends
Now, there is also a piece of advice being circulated which reads like this:

"Please do me a favor and move your mouse over my name here, wait for the box to load and then move your mouse over the "Subscribe" link. Then uncheck the "Comments and Likes". I would really rather that my comments on friends and families posts not be made public, thank You! Then re-post this if you don't want your every single move posted on the right side in the "Ticker Box" for everyone to see!"

This appears to be the most commonly suggested solution on Facebook, and it's rubbish! It still doesn't stop *your* posts being broadcast. It's an illusion. This option stops you seeing when other people have broadcast a message to a wide audience. It does *not* stop your actions being broadcast by your friends!
You have to do this for every single one of your friends. Time consuming *and* it does not solve the problem - it just stops you from seeing it.

Please don't spread this advice, as it is confusing people and stopping the real problem from being fixed.

How to tell if a post will broadcast to all your friends:
Under each post (on the right) there is an icon which will tell you who it was shared with:

Public
The globe icon means that the post is going to be public.

That means, if you comment your friends will be shown the comment immediately and that everyone on Facebook (except those people you have specifically blocked) can see it.

Friends
The icon showing two heads means that the post is shared with friends only.

It should be safe to comment, with no threat of exposure to strangers via the ticker/news feed.

Custom or Friends of Friends
A gear icon can actually mean one of two things - either Custom or Friends of Friends. You will have to hover your mouse over the icon to see which.

Custom means that the post will be safe to comment on with no leakage to strangers via the ticker/news feed.

Friends of Friends, however, can be considered unsafe - as all your friends and all of their friends will be shown the comment immediately via the ticker/news feed.
You can check your own posts easily that way if you want to make sure that your settings are right.

And don't forget - next time you leave a comment on someone else's Facebook post, don't say something that you may later regret.

If you're on Facebook, consider joining the Sophos Facebook page, where you can keep up-to-date on the latest rogue applications, scams and malware attacks threatening Facebook users.

View the original article here