Front-door tech is hot, and it’s not just Amazon who wants in

Most of us tend to think people trying to open the door when we’re away want to steal stuff. Amazon.com would like to change that assumption.

The e-commerce giant shelled out a reported $1.1 billion this week to acquire Ring, a developer of Wi-Fi-connected door bells. The move follows the rollout last year of Amazon Key, a smart lock and camera system for in-home deliveries to customers who don’t want packages sitting outside.

But Amazon’s not the only one placing high value on front-door tech. In the age of on-demand delivery, service providers have long seen the typical low-tech door as an impediment to expansion. Smart-lock developers and home security companies also have been putting resources into the space, alongside a number of venture investors.

As we reported a few months ago in an overview of smart-lock and building access investments, the way people open the front door hasn’t changed much in a century. Most of us still get in by turning a flat metal key into a lock. Visitors ring old-fashioned door bells. And there’s commonly no digital record of who came or why.

There’s a lot of money going into changing that status quo. Since last year, venture investors have poured more than $200 million into an assortment of companies with businesses and technologies tied to keys, locks and building access. To date, those companies have more than $500 million, according to an analysis of Crunchbase funding data.

Ring, which raised $200 million in venture funding, is one of two heavily funded companies to be acquired in recent months. In October, August Home, a smart-lock developer that had raised more than $70 million in venture funding, sold to ASSA ABLOY Group, the largest global supplier of door opening products, for an undisclosed sum.

There’s good reason to think the up cycle for smart locks and entry systems has further to go. For one, to a large degree, lock and building access-related investments are an extension of the connected home space, and growing adoption of connected home systems provides a major entry point for key and door tech.

Many legitimate businesses also want an easier way to get through the door. After all, delivering things to customers’ doors, either inside or out, constitutes an industry with a collective valuation in the trillions of dollars. Amazon.com alone is valued at more than $700 billion.

Additionally, anecdotally, it does appear urban humans over recent decades are trending toward greater laziness. Increasingly, people want their laundry, meal kits, produce, shaving supplies and pet treats delivered to their doors. Just as we used to think of going to the store as a pain, we will soon consider stepping outside to pick up a package as the height of inconvenience.

Those trends might not be great for the state of humanity. But they are bullish indicators for the smart lock industry.

Read More

Wireless companies are finally taking security seriously

Among the dozens of exciting ways to get hacked these days, none are more dangerous than the SIM port-out. Consumers have increasingly started using two-factor authentication to secure everything from Facebook to bank accounts, and often the 2FA security code is sent via a text message. So criminals are following the system, and persuading cell companies via a little social engineering to port out people’s numbers to a different company, putting control of the victim’s cell number — and thus any authentication text messages — in the hands of the criminals.

This has been possible because for years, cell companies haven’t used a robust system to verify customer identity over the phone for a port-out. All the carriers offered some kind of security code to secure your account, but it wasn’t mandatory, and often a combination of name, billing address and social security number — easily taken from something like the Equifax hack! — was enough to port out a number.

At this week’s Mobile World Congress in Barcelona, an industry group that includes all four major US carriers announced a “next-generation mobile authentication platform” that aims to solve 2FA fraud once and for all.

Rather than just addressing the security concerns around porting out numbers, which carriers are doing on their own, the “Mobile Authentication Taskforce” is working on a system that makes SMS messages a viable and secure authentication option. The “highly secure solution” will deliver a cryptographically verified phone number and profile data for users of authorized applications with their consent,” and further verification will come from examining factors like “a network verified mobile number, IP address, SIM card attributes, phone number tenure, phone account type.”

Reading between all the buzzwords, it seems that mobile carriers will use common online tells to flag up suspicious phone numbers — for example, if the number has an American area code and American billing address, the system might flag an attempted log-in from Russia.

The technology will begin internal trials in the “next few weeks,” with a full roll-out expected by the end of the year.

Read More

Hackers exploiting rTorrent to install Unix coin miner have netted $4k so far

Attackers have generated $3,900 so far in an ongoing campaign that's exploiting the popular rTorrent application to install currency-mining software on computers running Unix-like operating systems, researchers said Thursday.

The misconfiguration vulnerabilities are similar in some respects to ones Google Project Zero researcher Tavis Ormandy reported recently in the uTorrent and Transmission BitTorrent apps. Proof-of-concept attacks Ormandy developed exploited weaknesses in the programs' JSON-RPC interface, which allows websites a user is visiting to initiate downloads and control other key functions. Ormandy's exploits demonstrated how malicious sites could abuse the interface to run malicious code on vulnerable computers.

The in-the-wild attacks targeting rTorrent are exploiting XML-RPC, an rTorrent interface that uses HTTP and the more-powerful XML to receive input from remote computers. rTorrent doesn't require any authentication for XML-RPC to work. Even worse, the interface can execute shell commands directly on the OS rTorrent runs on.

Attackers are scanning the Internet for computers that are running RPC-enabled rTorrent apps and then exploiting them to install software that mines the digital coin known as Monero, researchers from Seattle-based security firm F5 said in a blog post. At the time this post was going live, the attacker wallets had a combined balance of $3,900. At their current rate, the attackers are generating about $43 per day. That's a modest sum compared to one cryptocurrency-mining group researchers said netted coins worth $3.4 million.

No user interaction required

The attack scenario against rTorrent is more severe than for uTorrent and Transmission because attackers can exploit vulnerable rTorrent apps with no interaction required of the user. The uTorrent and Transmission flaws, by contrast, could be exploited only by sites a user actively visited.

Ormandy's exploits used a technique known as domain name system rebinding to make an untrusted Internet domain resolve to the local IP address of the computer running a vulnerable BitTorrent app.
F5 was careful to note that the developer of rTorrent "explicitly recommends not using the RPC functionality over TCP sockets." This would indicate that the vulnerable XML-RPC interface isn't enabled by default. Many BitTorrent users find such interfaces useful and assume they can be controlled only by someone with physical access to the computer running it.

The susceptibility to DNS rebinding or other hacks invalidates the assumption, at least when the interface lacks password authentication or other security-in-depth measures, either because they're not provided by the developer or they're not enabled by end users.

The malware the exploit downloads doesn't just run compute- and electricity-draining mining software. It also scans infected computers for rival miners and, if found, attempts to remove them. At the moment, the downloaded malware is detected by only three of the top 59 antivirus providers. That number is likely to change soon.
In an e-mail sent after this post went live, rTorrent developer Jari Sundell wrote:

There is no patch as the vulnerability is due to a lack of knowledge about what is exposed when enabling RPC functionality, rather than a fixable flaw in the code. It was always assumed, from my perspective, that the user would ensure they properly handled access restriction.

No 'default behavior' for rpc is enabled by rtorrent, and using unix sockets for RPC is what I'm recommending.

The failure in this case is perhaps that I've created a piece of software that is very flexible, yet not well enough documented that regular users understand all the pitfalls.

People who run rTorrent should inspect their computers carefully for signs of infection, which likely include excessive amounts of bandwidth and computing power being consumed. rTorrent users should also ensure that they're following Sundell's advice. People running other BitTorrent apps should also remain wary of the RPC interface and turn them off whenever practical. View article comments

by: Dan Goodin

Read More

Microsoft releases Spectre fixes for Windows 10 on Skylake CPUs

Microsoft has pushed out a new set of Spectre (variant 2) security updates. For the moment, these are just for some devices running on Skylake CPUs and Windows 10 Fall Creators Update or Windows Server version 1709 (Server Core).

But, John Cable, Director of Program Management, Windows Servicing and Delivery, says that the company will continue to work with chipset and device makers as they offer more vulnerability mitigations.

The updates are available for download and manual installation from the Microsoft Update Catalog. It seems that, for now, this update will not be available via Windows Update.

“This update also includes Intel microcode updates that were already released for these Operating Systems at the time of Release To Manufacturing (RTM). We will offer additional microcode updates from Intel through this KB Article for these Operating Systems as they become available to Microsoft,” the company noted, and added that they are “not aware of any issues that affect this update currently.”

Fixing update implementation problems

As you might remember, users encountered problems with the implementation of the initial Microsoft Meltdown and Spectre patches in early January: those who had incompatible antivirus software had not been offered the security update.

In order to receive the update, the system must sport a specific registry key, and if it doesn’t, customers will not receive Meltdown, Spectre, or any future Microsoft security updates.
The key can be set up by compatible AV software or by users themselves (detailed information on how to do it is offered here). If you don’t use an anti-virus solution, you have to set up the registry key.

Cable says that Microsoft has also been working closely with their AV partners on compatibility with Windows updates and that the vast majority of Windows devices now have compatible AV software installed.

“The continued focus of our work with our AV partners and customers is to manage the risk of compatibility issues, especially those that result from AV software that makes unsupported calls into Windows kernel memory. Due to this potential risk, we require that AV software is up to date and compatible,” he noted.

“We will continue to require that an AV compatibility check is made before delivering the latest Windows security updates via Windows Update until we have a sufficient level of AV software compatibility. We recommend users check with their AV provider on the compatibility of their installed AV software products.”

Read More

Don’t fall for fake iTunes and App Store messages

Ever received an email that looks for all the world like it’s from Apple? Like, maybe a receipt from an iTunes purchase that you don’t remember making?

Well, that’s easy to fix, right? Just click on the link to update your account information and…
Ooops! Increasingly, chances are if you click, you wind up being phished.

Phishing scams that pose as official Apple emails are getting more and more sophisticated. On Tuesday, 9to5Mac reported on one recent version: phishing attacks posing as App Store subscription renewal messages.

On Friday, Apple posted a quick guide to help customers tell the difference between phishing emails and legitimate email from its App Store, iTunes Store, iBooks Store or Apple Music.

Apple says that scammy emails often resemble official Apple correspondence – same formatting, same language and same graphics. That includes, for example, the official apple-with-a-bite logo and/or that Apple Music pink and blue eighth note icon.

E-swindlers often try to trick us into sharing our personal or financial information by sending us messages or links to sites that look like they’re from Apple, but which in reality are out to steal our account information. From the iCompany’s post:

Some phishing emails will ask you to click on a link to update your account information. Others might look like a receipt for a purchase in the App Store, iTunes Store, iBooks Store or for Apple Music, that you’re certain you didn’t make.

“Never enter your account information on websites linked from” such messages, Apple said, and “never download or open attachments included within them.”

 

You might well ask OK, if I don’t click on that link, how can I correct what I know is a charge I didn’t make?

Easy, Apple says: if you get an email asking you to update your account or payment information, do it directly on your iOS device, under Settings, or do it in the Settings for the iTunes or App Store on your Mac, or in iTunes on a PC.

Ditto for requests to update your password: only do it in Settings on your device or at appleid.apple.com.

It’s great advice, and it echoes that handed out by Staysafeonline.org in the lead up to holiday shopping last year: Stop. Think. Connect.
Naked Security’s Paul Ducklin says you can try the logic on for size:

• If these messages are true, you don’t need to click – you can just head over to Apple’s website manually, or open the App Store app yourself.
• If the messages are not true, you don’t want to click, for obvious reasons.
• Therefore, true or false, your best action is not to click.

Here are some other red flags that can indicate that a phisher is spoofing emails from Apple:

• Requests for personal information, such as your taxpayer ID/Social Security Number, mother’s maiden name, full credit card number, or your credit card CCV code. Apple never asks for that information to be sent over email.
• No billing address. Genuine purchase receipts – from purchases in the App Store, iTunes Store, iBooks Store, or Apple Music – include your current billing address, which Apple says scammers are unlikely to have. You can also review your App Store, iTunes Store, iBooks Store or Apple Music purchase history.

If you’re thinking, Uh-oh, I think I already fell for something, Apple asks that you report it to reportphishing@apple.com. If you’re on a Mac, forward the email as an attachment from the Message menu.

And if you think you might have entered personal information like a password or credit card info on a scam website, Apple says you should immediately change your Apple ID password.

Read More

Can emojis save you from a terrible password?

 

Researchers might have discovered a simple way to get more computer users to opt for strong passwords – tell them how easy their weak choices would be to hack.

The idea comes from research conducted by a team led by the University of Plymouth’s Centre for Security, Communications and Network Research (CSCAN), which tested the effectiveness of password advice strategies through two experiments.

In the first, 300 users creating a website account were offered either no password advice at all or were aided by a password meter, emotive feedback message or emoji.

The latter prompts improved matters a lot: password choices rated as “weak” dropped from 75% for the group offered no guidance, to a third for those given the emotive feedback.
In a second experiment, 500 users in the US were told how quickly a hacker might crack their password choice, causing them to choose passwords that were longer and up to ten times as strong as a result.

This points to a curious effect: the way you tell people what they’re doing wrong can be as important as the fact you’re telling them at all.
Or, if you like, the abstract rating of a password meter isn’t likely to be as effective at changing human behaviour as an alarming message telling people their hopeless password is going to make like easy for criminals.

Ideally, sites shouldn’t allow users to create weak passwords in the first place, regardless of whether advice on their weakness is offered or not.

Last year a study by Dashlane found that numerous big web brands are astonishingly lax on this score, with some imposing apparently-sensible eight-character limits without also disallowing these from simply being a single character repeated eight times (‘11111111’).
But even sites that already have tight policies in place might be able to boost password security further by giving users strongly-worded feedback.
Study co-author, Professor Steve Furnell:

A common weakness in the provision of security is that while relevant features are present and available to be employed, users are often expected to use them with little upfront guidance, or ongoing support.

It’s as if some sites are reluctant to be too insistent about password strength in case they put users off. If so, adding emotional cues could be a way to overcome this.
It’s also true that even the best-crafted password counts for nothing if it has already been compromised.

On that front, Troy Hunt’s Have I Been Pwned (HIBP) site recently launched version two of Pwned Passwords which allows anyone to check a password to see whether it’s on the compromised naughty step – using one that turns up here would be a major security risk.

Or perhaps passwords are one of those insoluble conundrums and admins should focus instead on layering security using password throttling (limiting incorrect guesses), making sure password reset systems aren’t a backdoor, and enforcing multi-factor authentication.

Read More

UK and Australian governments now use Have I Been Pwned

Troy Hunt is turning Have I Been Pwned into an essential pwning monitoring service. The service monitors security breaches and password leaks so that you and your users remain secure. And now, the U.K. and Australian governments are monitoring their own domain names using the service.

Most people are familiar with the consumer-facing version of Have I Been Pwned. You go on Have I Been Pwned’s website and enter your email address. It shows you a list of services that you use and that have been hacked.

Many of those password databases leak in the wild, so the service checks your email addresses against those databases to show you how you’ve been exposed. And if you’ve been using Dropbox, LinkedIn, Tumblr or Adobe services, chances are you’ve been pwned.

That’s why you should be using a different password on each online service. This way, if your password leaks, nobody can connect to another service. Everything is sandboxed, you can just change the password on the hacked service.

And because nothing is secure anymore, you should activate two-factor authentication wherever you can. A password simply doesn’t cut it anymore.

Have I Been Pwned also lets you monitor all email addresses ending with the same domain name. For instance, if you run a company, you can monitor all the email addresses that end with

@myawesomecompany.com to see if any of your employee has been affected by a security breach.
This information is particularly important if you have a sensitive job for the government for instance. If you work for the British Home Office and use your @homeoffice.gsi.gov.uk email address to back something on Kickstarter, your Kickstarter password is now out there.

A hacker could try and re-use this password on your email address, send emails to other government members to ask for classify documents, etc.

Anyone can monitor a domain name by proving that you actually own the domain name (otherwise it would be a potential security breach). Hunt is now working with governments to make it easier to monitor all government domain names for free.

So the National Cyber Security Centre (NCSC) can now query all .gov.uk domain names, and the Australian Cyber Security Centre (ACSC) can query all .gov.au domain names. Pretty neat.

Read More

20,000 web certificate private keys outed in “business tiff”

Over the years, we’ve written about website security certificates many times.
That’s because HTTPS certificates (more properly, TLS certificates, formerly known as SSL certificates) are one of the cornerstones of online transaction security.

Web certificates put that padlock icon into your browser’s address bar – the padlock we’re always urging you to look out for if you’re a website visitor, and to provide if you’re a website operator.
To recap, TLS is short for Transport Layer Security. (TLS used to be known as SSL, or Secure Sockets Layer – you’ll still see the abbreviation SSL a lot.)

The TLS “chain of trust” provided by digital certificates, simplified very greatly, goes something like this:

• I use a certificate to vouch for the fact that a website really is mine to own and operate.
• I get a company called a Certificate Authority (CA) to vouch for my certificate by signing it with their certificate.
• Your operating system or browser maker to vouches for the CA by adding its certificate to a “master trust” list

This forms a chain of trust – your browser tells you that the CA is likely to tell the truth, the CA tells you that the website operator is likely to tell the truth, and the website operator tells you, “This site really is mine.”

Note. A TLS certificate doesn’t tell you that the web server you’re connecting to is secure, patched, safe, truthful, and so on – it vouches for the owner and operator of the site, thus making it much harder for a crook to set up an imposter server that is indistinguishable from yours.

Free award-winning computer security

Stop ransomware without lifting a finger

As you can see, there’s a lot that can go wrong here:

• A trusted CA could go rogue, or get acquired by a sloppier company, or sign certificates without doing proper checks.
• Crooks could steal a vendor’s certificate and start stamping that vendor’s official seal on their own malicious websites.
• Crooks could steal your certificate and set up an imposter site that looks completely genuine.

And so on.
As a result, the TLS certificate ecosystem needs to be able not only to introduce new certificates and CAs into the mix, but also to be able to disavow (to revoke, in technical jargon) individual certificates as well as entire CAs.

In an ideal world, revoking an entire CA would be a once-in-a-lifetime sort of affair: firstly, it’s pretty much game over for the CA’s business; secondly, invalidating a CA automatically also invalidates any certificates already signed by it.

If your CA gets struck off abruptly, you need to get a new certificate, signed by a new CA, as soon as possible, or everyone who visits your website is going to see an ominous browser warning advising them that your website can’t be trusted.

Losing trust

CAs that have lost the trust of the community over the years include Dutch company Diginotar, the Turkish CA TURKTRUST, the Chinese Wosign…
…and most recently, computer security behemoth Symantec.

Google has been up in Symantec’s face for close to a year now, arguing strongly that the community should “reduce, and ultimately remove, trust in Symantec’s infrastructure in order to uphold users’ security and privacy when browsing the web.”

Google’s claim was that Symantec’s infrastructure for issuing certificates – which covered a range of different brands the company had acquired over the years – just wasn’t up to scratch, so Symantec ought to get its house in order and reissue all its certificates, allowing all the old and unreliable ones to be revoked for the greater good of all.

In the end, this stand-off was resolved without too many tears: Symantec sold off its certificate business to rivals Digicert, who agreed a timetable during which it would issue its customers with replacement certificates before existing Symantec certificates were automatically distrusted by the world’s browsers.

Regaining trust

In the UK, however, this transition hasn’t gone entirely smoothly – with new owners Digicert getting into a spat with one of its London resellers, a boutique security business called Trustico.

According to the Register, Trustico decided it wanted to switch its customers with Symantec certificates away from new owners Digicert to rival CA Comodo – after all, you’d need a new certificate anyway (some old Symantec certificates automatically become untrusted on 2018-03-15; the rest will expire on 2018-09-13).

At the same time, Digicert had emailed Trustico customers whose certificates needed replacing (these users were, after all, now Digicert customers, too) to advise them about the certificate swapout process.
Trustico then demanded that Digicert revoke the affected certificates outright,

Digicert refused, apparently on the understandable grounds that unilaterally revoking individual certificates – in the absence of any overarching security concern – is a matter for the owners of the certificates, not for the resellers or the CAs that issued them.

Things get weird

Here’s where things get weird.
According to Digicert, Trustico emailed over the private keys for more than 20,000 certificates.
Of course, the private key is what makes the certificate yours and stops other people from abusing it, so you should really be the only person with a copy of your private key.

Anyway, the guidelines of the TLS certificate ecosystem say that if a certificate’s private key is known to have been exposed, then for everyone’s peace of mind, that certificate should be revoked within 24 hours.

According to Digicert, that’s exactly what then happened, given that the keys have been emailed across the internet, so Trustico abruptly got what it wanted anyway, as a convenient procedural side-effect.

What we can’t quite understand is how Trustico came to have copies of so many customers’ private keys in the first place, and why those keys were sent via email as some sort of a pawn in the “Symantec Sells Its Certificate Business” endgame.

As Trustico itself admitted, on the day the news broke of the mass key disclosure:

Unfortunately things didn’t go very well for us today and we are extremely sorry for all the confusion and inconvenience that has been caused. We believed that we had acted in accordance with the agreements and information that both DigiCert and Symantec had imposed and provided upon us.

What next?

This sort of public brouhaha doesn’t reflect very well on the digital certificate world.
We’re all expected to operate our websites over HTTPS these days – indeed, there are many excellent reasons for getting rid of HTTP entirely, forever, in return for additional community security and privacy.

But a public spat like this, where customers’ private keys seem to have turned into business bargaining chips, doesn’t do anyone any favours.

Now it’ll be harder than ever to convince HTTP holdouts (or “HTTPS refuseniks”, if you prefer) to convert their websites to HTTPS.

by: Paul Ducklin

Read More