Information Technology

Image: Merget et al.

A team of academics has disclosed today a theoretical attack on the TLS cryptographic protocol that can be used to decrypt the HTTPS connection between users and servers and read sensitive communications.
Named Raccoon, the attack has been described as “really hard to exploit” and its underlying conditions as “rare.”
How the Raccoon attack works
According to a paper published today, the Raccoon attack is, at its base, a timing attack, where a malicious third-party measures the time needed to perform known cryptographic operations in order to determine parts of the algorithm.
In the case of a Raccoon attack, the target is the Diffie-Hellman key exchange process, with the aim being to recover several bytes of information.
“In the end, this helps the attacker to construct a set of equations and use a solver for the Hidden Number Problem (HNP) to compute the original premaster secret established between the client and the server,” the research team explained.

Image: Merget et al.
According to the researchers, all servers that use the Diffie-Hellman key exchange in setting up TLS connections are vulnerable to attacks.
This is a server-side attack and cannot be performed on a client, such as browsers. The attack also needs to be executed for each client-server connection in part, and cannot be used to recover the server’s private key and decrypt all connections at once.
Servers that use the Diffie-Hellman key exchange and TLS 1.2 and below are considered vulnerable. DTLS is also impacted.
TLS 1.3 is considered safe.
Not a practical attack
But despite having the capability to decrypt TLS sessions and read sensitive communications, the research team was also the first to admit that the Raccoon attack was also extremely hard to pull off.
For starters, the attack requires that certain and extremely rare conditions be met.
“The vulnerability is really hard to exploit and relies on very precise timing measurements and on a specific server configuration to be exploitable,” researchers said.
“[The attacker] needs to be close to the target server to perform high precision timing measurements. He needs the victim connection to use DH(E) and the server to reuse ephemeral keys. And finally, the attacker needs to observe the original connection.
“For a real attacker, this is a lot to ask for,” academics said.
“However, in comparison to what an attacker would need to do to break modern cryptographic primitives like AES, the attack does not look complex anymore.
“But still, a real-world attacker will probably use other attack vectors that are simpler and more reliable than this attack,” researchers added.
While the attack has been deemed hard to exploit, some vendors have done their due diligence and released patches. Microsoft (CVE-2020-1596), Mozilla, OpenSSL (CVE-2020-1968), and F5 Networks (CVE-2020-5929) have released security updates to block Raccoon attacks.
Additional technical details are also available on a dedicated website and in a research paper titled “Raccoon Attack: Finding and Exploiting Most-Significant-Bit-Oracles inTLS-DH(E)” [PDF]. More

The organizations behind the Bluetooth wireless technology has published guidance today on how device vendors can mitigate a new attack on Bluetooth capable devices.
Named BLURtooth, this is a vulnerability in a component of the Bluetooth standard named Cross-Transport Key Derivation (CTKD).
This component is used for negotiating and setting up authentication keys when pairing two Bluetooth-capable devices.
The component works by setting up two different sets of authentication keys for both the Bluetooth Low Energy (BLE) and Basic Rate/Enhanced Data Rate (BR/EDR) standard.
CTKD’s role is to have the keys ready and let the paired devices decide what version of the Bluetooth standard they want to use. It’s primary use is for the Bluetooth “dual-mode” feature.
BLURtooth attack leads to key overwrite
But according to security notices published today by the Bluetooth Special Interest Group (SIG) and the CERT Coordination Center at the Carnegie Mellon University (CERT/CC), an attacker can manipulate the CTKD component to overwrite other Bluetooth authentication keys on a device, and grant an attacker connecting via Bluetooth access to other Bluetooth-capable services/apps on the same device.
In some versions of the BLURtooth attack, the authentication keys can be overwritten completely, while in other authentication keys can be downgraded to use weak encryption.
All devices using the Bluetooth standard 4.0 through 5.0 are vulnerable. The Bluetooth 5.1 standard comes with features that can be activated and prevent BLURtooth attacks.
Bluetooth SIG officials say they started notifying vendors of Bluetooth devices about the BLURtooth attacks and how they could mitigate its effects when using the 5.1 standard.
Patches… uhm… will be ready… when they’re ready
Patches are not immediately available at the time of writing. The only way to protect against BLURtooth attacks is to control the environment in which Bluetooth devices are paired, in order to prevent man-in-the-middle attacks, or pairings with rogue devices carried out via social engineering (tricking the human operator).
However, patches are expected to be available at one point. When they’ll be, they’ll most likely be integrated as firmware or operating system updates for Bluetooth capable devices.
The timeline for these updates is, for the moment, unclear, as device vendors and OS makers usually work on different timelines, and some may not prioritize security patches as others. The number of vulnerable devices is also unclear and hard to quantify.
Users can keep track if their device has received a patch for the BLURtooth attacks by checking firmware and OS release notes for CVE-2020-15802, the bug identifier of the BLURtooth vulnerability.
According to the Bluetooth SIG, the BLURtooth attack was discovered independently by two groups of academics from the École Polytechnique Fédérale de Lausanne (EPFL) and Purdue University. More

Singapore will begin issuing COVID-19 contact tracing wearables to all residents and introducing additional safety measures, as it looks to resume more public activities in the coming weeks. These new measures will include the mandatory use of the TraceTogether Tokens or contact tracing app TraceTogether to facilitate digital check-in procedures at some locations where ‘higher-risk activities” are held.
A new “Self-Check” service and SMS service also would be rolled out on Thursday to alert people if they had visited the same venues at the same time as COVID-19 cases, said the Health Ministry and Smart Nation and Digital Government Office in a joint statement Wednesday. Both services would be based on data from individuals’ SafeEntry check-ins.

The government agencies said the new measures were necessary to support the country’s further opening of the economy “by ensuring more effective contact tracing for the community”.
To date, its TraceTogether app has topped 2.4 million downloads, accounting for about 40% of the local population. 
An initial batch of 10,000 Bluetooth-enabled TraceTogether Tokens were distributed to the elderly in June, days after the country’s plans to introduce the wearables sparked public outcry amongst individuals concerned about their privacy. It prompted the government to reveal that the contact tracing devices did not contain a GPS chip and would not have internet or cellular connectivity, so the data collected could only be extracted when the devices were physically handed over to a health official. 
The government had explained that the wearable devices were essential to plug gaps within the community where, for instance, children or individuals who did not have a smartphone would not be able to download the TraceTogether contact tracing app. It said the TraceTogether Tokens also offered an option for others who preferred to use a separate device to facilitate Singapore’s digital contact tracing efforts. 
The wearable devices would be distributed nationwide from September 14, with the government targeting to issue the token for free to all residents by November. The device’s battery has an estimated lifespan of six months and will not require any additional charging.  
Records of proximity data of close contacts are encrypted and stored locally in the token for up to 25 days. This data can be accessed only by the relevant authorities and only if a user is confirmed to be a COVID-19 case. 
Plans were underway to further pilot the mandatory use of the TraceTogether app or wearable to facilitate SafeEntry check-ins at selected venues that held higher-risk activities, such as larger-scale business-to-business events. This would be further expanded over time as the distribution of the wearables widened, the Singapore government said. These could include venues such as hotels, which often were used for weddings, F&B outlets, cinemas, gyms, and some workplaces. 
“As such settings have the potential to spark off large outbreaks from a single positive COVID-19 case that spread beyond the activity or venue, the use of TraceTogether can facilitate rapid and comprehensive contact tracing to stem onward spread,” the government said. 
SafeEntry currently already is compulsory at several locations including all workplaces, shopping malls, hotels, schools and educational institutes, healthcare facilities, supermarkets, and hairdressers. Since its launch, the digital check-in system has clocked an average of 9 million check-ins a day and tapped by more than 2.2 million unique users across 200,000 locations.
The system collects data that can be used to facilitate contact tracing should an individual who visited the location test positive for COVID-19. QR codes are displayed at the entry and exit points of a venue, which visitors must scan and input their name, national identification number, and mobile number. Alternatively, they can use any identification card that carries a barcode such as their driver’s licence, work permit, or student pass, which is then scanned by staff stationed at the venue’s entry point. 
With the launch of the “Self-Check” service, individuals will be able to refer to their SafeEntry records to check if they have been in close proximity to COVID-19 cases. 
The new SMS notification alerts also will be sent to groups of individuals who were at locations assessed to pose a higher risk of transmission, such as dining places and gyms where people do not wear masks for extended periods of time. Those whose SafeEntry check-in and check-out times that overlap with COVID-19 cases in such locations will receive an SMS alert. 
From October, Singapore is permitting bigger exhibitions and conferences comprising up to 250 participants to resume on a trial basis, where organisers will have to apply to pilot such Meetings, Incentives, Conventions, and Exhibitions (MICE). 
The country today confirmed 75 new COVID-19 cases, including 14 that were imported. It has just over 57,160 cases in total and 27 fatalities, with the most recent death recorded on July 14.

(Source: Singapore’s Smart Nation and Digital Government Office)

×
tracetogether-singapore-covid.png

RELATED COVERAGE More

“I have nothing to hide” was once the standard response to surveillance programs utilizing cameras, border checks, and casual questioning by law enforcement.
Privacy used to be considered a concept generally respected in many countries — at least, in the West — with a few changes to rules and regulations here and there often made only in the name of the common good.
Things have changed, and not for the better.
China’s Great Firewall, the UK’s Snooper’s Charter, the US’ mass surveillance and bulk data collection — compliments of the National Security Agency (NSA) and Edward Snowden’s whistleblowing — Russia’s insidious election meddling, and countless censorship and communication blackout schemes across the Middle East are all contributing to a global surveillance state in which privacy is a luxury of the few and not a right of the many.
As surveillance becomes a common factor of our daily lives, privacy is in danger of no longer being considered an intrinsic right.
Everything from our web browsing to mobile devices and the Internet of Things (IoT) products installed in our homes have the potential to erode our privacy and personal security, and you cannot depend on vendors or ever-changing surveillance rules to keep them intact.
Having “nothing to hide” doesn’t cut it anymore. We must all do whatever we can to safeguard our personal privacy. Taking the steps outlined below can not only give you some sanctuary from spreading surveillance tactics but also help keep you safe from cyberattackers.
Also: Cybersecurity is broken: How we start to fix it | All the Chromium-based browsers
Data management is at the heart of privacy
Data is a vague concept and can encompass such a wide range of information that it is worth briefly breaking down different collections before examining how each area is relevant to your privacy and security.
Personally Identifiable Information

Known as PII, this can include your name, physical home address, email address, telephone numbers, date of birth, marital status, Social Security numbers (US)/National Insurance numbers (UK), and other information relating to your medical status, family members, employment, and education.
Why does it matter? All this data, whether lost in different data breaches or stolen piecemeal through phishing campaigns, can provide attackers with enough information to conduct identity theft, take out loans using your name, and potentially compromise online accounts that rely on security questions being answered correctly. In the wrong hands, this information can also prove to be a gold mine for advertisers lacking a moral backbone.
Browsing habits and website visits
Internet activity is monitored by an Internet Service Provider (ISP) and can be hijacked. While there is little consumers can do about attacks at the ISP level, the web pages you visit can also be tracked by cookies, which are small bits of text that are downloaded and stored by your browser. Browser plugins may also track your activity across multiple websites.
Why does it matter? Cookies are used to personalize internet experiences and this can include tailored advertising. However, such tracking can go too far, as shown when the unique identifiers added to a cookie are then used across different services and on various marketing platforms. Such practices are often considered intrusive.
Also: New malware targets Macs to steal from cryptocurrency wallets | Want Google to track you less?

Special feature

Cyberwar and the Future of Cybersecurity
Today’s security threats have expanded in scope and seriousness. There can now be millions — or even billions — of dollars at risk when information security isn’t handled properly.
Read More

Message and email content
Our email accounts are often the pathway that can provide a link to all our other valuable accounts, as well as a record of our communication with friends, families, and colleagues.
Why does it matter? If an email account acts as a singular hub for other services, a single compromise can snowball into the hijack of many accounts and services.
Online purchases, financial information
When you conduct a transaction online, this information may include credentials for financial services such as PayPal, or credit card information including card numbers, expiry dates, and security codes.
Why does it matter? Cybercriminals who steal financial services credentials through phishing and fraudulent websites, who eavesdrop on your transactions through Man-in-The-Middle (MiTM) attacks, or who utilize card-skimming malware, can steal these details when they are not secured.
Once this information has been obtained, unauthorized transactions can be made, clone cards may be created, or this data may also be sold on to others in the Dark Web.

Medical records and DNA profiles
Another entrant to the mix, hospitals are now transitioning to electronic records and home DNA services store genetic information belonging to their users, submitted in the quest for health-related queries or tracing family histories.
Why does it matter? The loss of medical information, which is deeply personal, can be upsetting and result in disastrous consequences for everyone involved. 
When it comes to DNA, however, the choice is ours whether to release this information — outside of law enforcement demands — and it is often the use of ancestry services that release this data in the first place. Privacy concerns relating to DNA searches have been cited for sales downturns with some popular home ancestry kits.
Also: On the dangers of DNA data: Genealogy tests, Elizabeth Warren, and the end of privacy | Before taking that DNA test: Six things you need to know
What is being done to protect this information?
Businesses that handle data belonging to their customers are being scrutinized more and more with the arrival of regulatory changes such as the EU’s General Data Protection Regulation, designed to create a level playing field and stipulate adequate security measures to protect consumer privacy and data.
Companies will often encrypt your information as part of the process, which is a way to encode information to make it unreadable by unauthorized parties.
One way this is achieved is by using SSL and TLS certificates that support encryption on website domains. While usually a paid service, Let’s Encrypt also offers free SSL/TLS certificates to webmasters who wish to improve their websites’ security. (Unfortunately, this has also led to the adoption of SSL by fraudsters.)
Apple, Google, and Mozilla have gone against a CA/B Forum ballot and have decided to reduce the lifespan of TLS certificates to 398 days, starting September 1.
End-to-end encryption is also becoming more popular. This form of encryption prevents anyone except those communicating from accessing or reading the content of messages, including vendors themselves.
Following Snowden’s disclosure of the NSA’s mass surveillance activities, end-to-end encryption has been widely adopted by many online communication services. With a recent shift to working from home practices prompted by COVID-19, this has expanded to include video conferencing tools.
Privacy advocates may cheer, but governments and law enforcement agencies have not rejoiced at the trend — and a political battlefield has emerged between tech vendors and governments that are attempting to enforce the inclusion of deliberate backdoors into encrypted systems.
It is up to us to make use of any privacy-enabling technology we have at hand. Below are some guides with simple steps to get you started.
Also: Five years on, Snowden inspired tech giants to change | Tech’s invasion of our privacy made us more paranoid CNET
Browser basics and Tor
Searching the web is a daily activity for many of us, and as such, it is also a hotbed for tracking and potential cyberattacks.
The most commonly-used browsers are Google Chrome, Apple Safari, Microsoft Edge, Opera, and Mozilla Firefox. However, you should consider using Tor if you want to truly keep your browsing private.
The Tor Project is an open-source browser that is privacy-focused. The software creates tunnels rather than establishing direct connections to websites, which prevents users from being tracked through traffic analysis or IP addresses.

Not to be confused with the Dark Web — although required to access it and .onion domains in general — Tor is legal and is often used by the privacy-conscious, including journalists, activists, civil rights groups, and NGOs.
The Tor browser can be slightly slower than traditional browsers, but it is still the best choice for secure browsing. The non-profit recently launched a membership program to secure funding and boost integration in third-party products.
Desktop and mobile versions of the Tor browser are also available: desktop, the iOS Onion Browser, and Orbot: Tor for Android.
Also: Firefox to add Tor Browser anti-fingerprinting | Why you’re using Tor wrong
Secure other browsers
If you are more comfortable using Chrome, Safari, Firefox, Microsoft Edge, or another browser, there are still ways to improve your security without implementing major changes to your surfing habits.
Cookies: Clearing out your cookie caches and browser histories can prevent ad networks from collecting too much information about you. The easiest way to do so is to clear the cache (Firefox, Chrome, Opera, Safari, Edge).
You can also set your preferences to prevent websites from storing cookies at all. In order to do so, check out these guides for Firefox, Chrome, Opera, Safari, and Edge.
HTTP v. HTTPS: When you visit a website address, you will be met with either Hypertext Transfer Protocol (HTTP) or Hypertext Transfer Protocol Secure (HTTPS). The latter option uses a layer of encryption to enable secure communication between a browser and a server.
The most important thing to remember is while HTTPS is best used by default in general browsing, when it comes to online purchases it is crucial to protecting your payment details from eavesdropping and theft.
It is still possible for payment details to be stolen on the vendor’s side, but to reduce the risk of theft as much as possible you should not hand over any important information to websites without HTTPS enabled. (It is estimated that shopping cart conversion rates increase by 13 percent with HTTPS enabled, which should encourage webmasters to use the protocol, too.) 
To find out whether HTTPS is enabled, look in the address bar for “https://.” Many browsers also show a closed padlock.
Search engines
Google’s search engine, alongside other major options such as Yahoo! and Bing, make use of algorithms based on your data to provide “personalized” experiences. However, browsing histories and search queries can be used to create user profiles detailing our histories, clicks, interests, and more, and may become invasive over time.
To prevent such data from being logged, consider using an alternative that does not record your search history and blocks advertising trackers. These options include DuckDuckGo, Qwant, and Startpage.
If you wish to stay with your current browser you can also use software that bolts-on to your browser to enhance the privacy and security of your surfing activities.
Browser plugins
HTTPS Everywhere: Available for Firefox, Chrome, and Opera, HTTPS Everywhere is a plugin created by the Tor Project and Electronic Frontier Foundation (EFF) to expand HTTPS encryption to many websites, improving the security of your communication with them.
NoScript Security Suite: Endorsed by Edward Snowden as a means to combat government surveillance, this plugin has been built for Firefox and other Mozilla-based browsers for the purposes of disabling active content including JavaScript, which may be used to track your online activity. Users can also choose which domains to trust and whitelist.
Disconnect: Another worthy addition to the list, Disconnect provides a visual guide to websites that are tracking your activity. Invisible trackers that monitor you and may also expose you to malicious content can be blocked. Disconnect is available for Chrome, Firefox, Safari, and Opera.
Facebook Container: In a time where Facebook has come under fire for its data collection and sharing practices time after time, Mozilla’s Facebook Container application is a worthwhile plugin to download if you are worried about the social media network tracking your visits to other websites. The plugin isolates your Facebook profile and creates a form of browser-based container to prevent third-party advertisers and Facebook tracking outside of the network. While not bulletproof, this add-on is worth considering if you want to separate Facebook from the rest of your browsing activities.
Blur: Blur, available for Firefox and Chrome, is an all-around plugin to protect your privacy and security. While the add-on can be used as a password manager and generator, ad blocking, and encryption, the true value is the use of “masked cards” in the premium version of the software. When data breaches occur, financial information is often the target. With this plugin, however, throwaway virtual cards are used with online vendors in replacement for the direct use of your credit card data, keeping it safe should a cyberattack occur.
Privacy Badger: Last but certainly not least, the EFF’s Opera, Firefox, and Chrome-supporting plugin Privacy Badger is focused on preventing ad networks from tracking you. The software monitors third parties that attempt to track users through cookies and digital fingerprinting and will automatically block those which use multiple tracking techniques. The plugin also includes color-coded indicators of domain tracking scripts.
Also: Microsoft security chief: IE is not a browser, so stop using it | Researcher publishes Google Chrome exploit

Public Wi-Fi: A security risk?
There is no denying that public Wi-Fi hotspots are convenient, especially in a time when many of us are working outside of the office. However, you may be placing your privacy and security at risk if you choose to use one while on the move without the right precautions.
The problem with them is simple: As you do not need authentication to access them, neither do cyberattackers — and this gives them the opportunity to perform what is known as Man-in-The-Middle (MiTM) attacks in order to eavesdrop on your activities and potentially steal your information, as well as manipulate traffic in a way to send you to malicious websites.
Hackers may be able to access the information you are sending through the Wi-Fi hotspot, including but not limited to emails, financial information, and account credentials. Hackers may also set up their own rogue honeypot Wi-Fi points that appear legitimate whilst only being interested in stealing the data of those who connect to it.
It is best not to use a public, unsecured Wi-Fi connection at all. An alternative and far more secure method is always to use a mobile 4G/5G/LTE connection through your own mobile device when possible.
If you need an internet connection for a device other than your smartphone, an easy way to accomplish this is to set up your mobile device as a mobile Wi-Fi hotspot itself. You can usually find this option in your main scroller menu, or under Wi-Fi settings.
There are other precautions you can take to make a public Wi-Fi hotspot safer — but it’s never devoid of risk.
When you connect to a new Wi-Fi hotspot on Microsoft Windows machines, make sure that you select “Public” when the option appears, as this will enable the operating system to turn off sharing; turn off the Wi-Fi connection when you do not need it, enable firewalls, and try to only visit websites with HTTPS enabled.
In addition, do not use the Wi-Fi hotspot to access anything valuable, such as an online banking service. 

One of the most important layers of security to implement is the use of a virtual private network (VPN) if accessing a public Wi-Fi hotspot — and the use of a trustworthy VPN should be implemented across all your devices, no matter your connection type.
Also: How to fix coffee-shop Wi-Fi | How to set up a satellite Wi-Fi hotspot
VPNs: Why, when, and where?
A virtual private network is a way to create a secure tunnel between browsers and web servers. Data packets are encrypted before they are sent to a destination server, which also results in IP addresses and your location becoming hidden. Many VPNs will also include a ‘kill switch’ that cuts off your internet access temporarily if a connection drops in order to keep your online activity secure.
VPNs have now entered the mainstream. Many users only adopt these services to access geolocation-blocked content — such as websites and apps banned in select countries — for example, a user in the United States could make themselves appear to be located in the United Kingdom, and vice versa.
However, VPNs have also surged in popularity in response to increased surveillance, making their use a popular option for activists or those in countries ruled by censorship. In addition, some organizations will require their employees to now use a VPN when accessing corporate resources remotely. 
(For a more detailed look at how VPNs operate, check out our guide.)
VPNs are not a silver bullet for security; far from it, but they can help mask your online presence. It is worth noting, however, that VPN usage is banned in some countries.
Free vs. premium VPNs
Premium, paid services are often more trustworthy. Free options are often slower and will offer limited bandwidth capacity. VPNs cost money to run and so providers will also require users of free services to agree to alternative means for them to turn a profit — and this may include tracking and selling your data.
Remember, when you are using a free service, whether it’s a VPN or Facebook, you are the product and not the customer.
(If you’re technically able, you could also set up your own private VPN. A handy set of instructions can be found here.)
Which VPN should I use?
The most important element to consider when deciding on a VPN is trust. Using a VPN requires all your traffic to go through a third-party. If this third-party VPN is unsecured or uses this information for nefarious reasons, then the whole point of using a VPN for additional privacy is negated.
Conflicts of interest, VPN providers being hosted in countries of which governments can demand their data, and sometimes less-than-transparent business practices can all make finding a trustworthy option a complex and convoluted journey.
However, to make this trip easier, our favorites include NordVPN, Private Internet Access, ExpressVPN, and TorGuard. CNET has also provided an up-to-date directory of good VPN options.
Also: VPN services: The ultimate guide | Why free VPNs are not a risk worth taking | With everyone working from home, VPN security is now paramount | Best VPN services for your home office in 2020: ExpressVPN, NordVPN, and more

Passwords and vaults
This kind of advice is repeated ad nauseam but it is worth saying again: using complex passwords is the first line of defense you have to secure your online accounts.

Thankfully, many vendors now actively prevent you from using simple combinations that are easy to break, such as QWERTY12345 or PASSWORD123, with dictionary-based and brute-force attacks. In July, researchers found that one out of every seven passwords in use is still ‘123456’.
However, it is difficult to remember complicated password credentials when you are using multiple online services, and this is where password vaults come in.
Password managers are specialized pieces of software used to securely record the credentials required to access your online services. Rather than being required to remember each set of credentials, these systems keep everything in one place, accessed through one master password, and they will use security measures such as AES-256 encryption to prevent exposure.
[embedded content]
Vaults may also generate strong and complex passwords on your behalf, as well as proactively change old and weak ones.
It is true that password managers and vaults may have vulnerable design elements that can be exploited on already-compromised machines, but when you balance risk, it is still recommended to use such software. Vendors with the best ratings include LastPass, Keeper, and Blur, but for a full range, check out CNET’s password manager directory.
Enable Two-factor authentication (2FA)
Two-factor authentication (2FA) is a widely-implemented method of adding an extra layer of security to your accounts and services after you have submitted a password.
The most common methods are via an SMS message, a biometric marker such as a fingerprint or iris scan, a PIN number, pattern, or physical fob. Using 2FA does create an additional step to access your accounts and data.
How to enable 2FA: Facebook | Twitter | Instagram | Snapchat | Apple iOS | Google | Microsoft | Amazon
You can also use standalone mobile apps to add 2FA to websites. Google Authenticator, available for Android and iOS, is a popular option, as well as Authy.
Also: CNET: Two-factor authentication: What you need to know | New tool automates phishing attacks that bypass 2FA
SIM hijacking:
2FA is a strong security standard, but if you are unlucky enough to become a victim of SIM hijacking, this layer of security means very little. SIM-wapping occurs when a cybercriminal poses as you to a service provider, such as AT&T, using social engineering techniques and information gathered about you to fool employees into transferring ownership of your mobile number. 
Once they have secured your phone number, they have a small window of time to hijack online accounts — such as emails, bank accounts, or cryptocurrency wallets — before you notice your service has ended. In this time, attackers may be able to access 2FA codes. 
In July, AT&T became the subject of a lawsuit centered around a customer who allegedly lost $1.9 million in cryptocurrency due to a SIM-swap attack.
This type of fraud is difficult to protect against. However, one way to do so is to connect 2FA telephone numbers to a secondary number that is not publicly known and so could only become subject to a SIM-swap if leaked elsewhere. 
Read on: Here’s how I survived a SIM swap attack after T-Mobile failed me – twice
Secure your mobile devices
Mobile devices can act as a secondary means of protection for your online accounts via 2FA, but these endpoints can also be the weak link that completely breaks down your privacy and security.
Both Apple iPhones and mobile devices based on Google’s Android operating system have sell by the millions. Android has maintained the lion’s share of the global smartphone and tablet market for years, but due to its popularity, the majority of mobile malware samples are geared towards this OS.
The open source nature of Android has also opened the way for hackers to search for vulnerabilities in its code, but to combat this, Google does run a bug bounty program and consistent security patch cycle for vendors.
iOS, in contrast, is a proprietary operating system and iPhones are generally considered more secure — despite the emergence of security flaws on occasion, which are almost laughable.
(Google has previously said that Android security is now as good as iOS, but we are still waiting to see the real-world evidence of this claim.)
Patch, patch, patch
The first and easiest way to keep mobile devices on either platform secure is to accept security updates when they appear over the air. These patches resolve new bugs and flaws, as well as sometimes provide performance fixes, and can keep your device from being exploited by attackers.
To check your device is up to date on iOS, go to Settings > General > Software Update. On Android, go to Settings > Software Update.
Lock it down
It sounds simple, but many of us don’t do it — make sure your mobile device is locked in some way to prevent physical compromise.
You can turn on your iPhone’s Passcode feature to enter a four or six-digit passcode, as well as select the ‘custom’ option to set either a numeric or alphanumeric code. On iPhone X and later, go to Settings > Face ID & Passcode, while on earlier iPhone devices, go to Settings > Touch ID & Passcode. If TouchID is not a feature on your iPhone, the menu option will simply show Passcode.
On Android, you can choose to set a pattern, PIN number, or password with a minimum of four digits. You can choose by tapping Settings > Security & location/Security > Lock Screen.
Biometrics
Face recognition, iris scanning, and fingerprints are biometric authentication options found on modern iPhones and Android devices. These services can be convenient, although it is worth noting that in the US, law enforcement may be able to force you to unlock your devices as biometrics are under question when it comes to the Fifth Amendment.
Find your phone
We want to stop ourselves from being monitored without consent, but some technologies can be beneficial for tracking down our own lost or stolen property.
Find my iPhone is a security feature for iOS devices that you can enable to allow you to track your device through iCloud. The system also includes a remote lock to prevent others from using your iPhone, iPad, or iPod Touch in the case of theft.
In order to enable Find my iPhone, go to Settings > [your name] > iCloud. Scroll to the bottom to tap Find my iPhone, and slide to turn on.
Google’s Find My Device can be used to ring a missing device, remotely secure your smartphone, and also wipe all content on your stolen property. The service is automatically made available by default once a Google account is connected to your device but it does require the device to be turned on, to have an active internet connection, and to have both location and the Find My Device feature enabled.
In order to do so, open Settings > Security & Location/Security > Find My Device.
Also: Two-thirds of all Android antivirus apps are frauds | The 10 best smartphones you can buy right now
Other privacy settings
For the iPhone
USB Restricted Mode: A handy security feature introduced in iOS 11.4.1, USB Restricted Mode prevents USB accessories from automatically being able to connect to an iPhone if an hour has elapsed since the last time it was unlocked. In order to enable, go to Settings > Touch ID/Face ID > USB Accessories.

Android
Disable the option to enable unknown developers/apps: If there have been apps you simply had to install outside of Google Play, make sure the “Unknown Sources” or “Install Unknown Apps” option is not left open afterward. Sideloading isn’t necessarily a problem on occasion but leaving this avenue open could result in malicious .APKs making their way onto your smartphone.
To disable it, select Settings > Security > Unknown Sources. On the later Android models, the option is usually found in Settings > Apps > Top-right corner > Special access.
Encryption: Depending on your smartphone’s model, you may have to enable device encryption, or some will be encrypted by default once a password, PIN, or lock screen option is in place. If you have such a device you can generally encrypt your smartphone through Settings > Security > Encrypt Device.
Other models, such as the Samsung Galaxy S8, do not have this option as encryption is enabled by default but you can choose to encrypt accompanying SD cards by going to Settings > Security > Encrypt SD card.
You can also choose to enable the Secure Folder option in the same settings area to protect individual folders and files.
Also: The 10 best ways to secure your Android phone
Jailbreaking
Rooting your device to allow the installation of software that has not been verified by vendors or made available in official app stores has security ramifications. You may not only invalidate your warranty but also open up your device to malware, malicious apps, and data theft.
An example of this is KeyRaider, a malicious campaign uncovered by Palo Alto Networks in 2015. The malware specifically targeted jailbroken iOS devices, leading to the theft of 225,000 Apple accounts and their passwords.
Also: iOS 12: Change these privacy and security settings now | Facebook makes GDPR push with new data privacy settings
Encrypt your messages
There was once a time when Pretty Good Privacy (PGP) was one of only a handful of options available to secure and encrypt your online communication that existed. PGP is a program that can be used for cryptographic protection, however, PGP is complicated to set up and use and there are other options out there that are more palatable to the average user.
If you still wish to use PGP, the Electronic Frontier Foundation has useful guides on its implementation for Windows, macOS, and Linux. 
Keybase.io, an open-source app built based on PGP for mobile and desktop systems available for macOS/iOS, Android, Linux, and Windows, is another option for making use of PGP and end-to-end encryption without the technical difficulties usually involved.
There are a number of encrypted messaging applications:
Signal
Signal is widely regarded as the most accessible, secure messaging service in existence today. Available for Android, iOS, macOS, and Windows, the free app — developed by Open Whisper Systems — implements end-to-end encryption and no data is stored by the company’s servers, which means that none of your conversations can be seized or read by law enforcement or hackers.
In order to use the service, you will need to tie a phone number to the app. You can also use Signal to replace traditional SMS messaging, but the same encryption and protections do not apply unless both recipients are using the app.
WhatsApp
WhatsApp is an alternative messaging app, which completed a rollout of end-to-end encryption across all compatible devices in 2016.
Available for Android, iOS, Windows Phone, macOS, Windows, and desktop, the messaging app is a simple and secure means to conduct chats between either a single recipient or a group. Having grown even more popular in recent years — perhaps more so as a way for colleagues to communicate while they work from home — and now boasting over one billion users, WhatsApp is certainly worth downloading to replace traditional chat apps. However, to tighten things up, make sure you visit the Chat Backup option in “Chats” and turn it off.
iMessage
Apple’s iMessage, a communications platform that comes with Mac and iOS products, is another option if you want to secure and protect your digital communications.
Messages are encrypted on your devices via a private key and cannot be accessed without a passcode. However, if you choose to back up your data to iCloud, a copy of the key protecting these conversations is also stored.
In order to keep your messages truly private, turn off the backup option. Apple will then generate an on-device key to protect your messages and this is not stored by the company.
In addition, only conversations taking place between iPhones — rather than an iPhone and Android device, for example — are encrypted. 2FA must be implemented to use end-to-end encryption.
Apple Card transactions — on iOS 12.4 or later — home and health data, the iCloud keychain, Safari search history, map favorites, Siri data, Wi-Fi passwords, and more, can be encrypted and stored via iCloud. 
Facebook Messenger
Facebook Messenger is not encrypted by default, and the social media giant says rolling out encryption could take years. The chat service does, however, have a feature called “Secret Conversations” on iOS and Android — but not the standard web domain — which is end-to-end encrypted.
In order to start a secret conversation, go to the chat bubble, tap the “write” icon, tap “Secret,” and select who you want to message. You can also choose to set a timer for messages to vanish.
Telegram
Telegram is another popular chat application worth noting as many presume chats made through this app are automatically secure and end-to-end encrypted — which is not the case.
Available for Android, iOS, Windows Phone, macOS, Linux, Windows, and desktop, Telegram does have a “Secret Chat” option that is end-to-end encrypted and kept away from the Telegram cloud. These particular chats are device-specific and include a self-destruct option.
Also: Why social media fatigue is spreading | The hacker’s paradise: Social networks
Mobile application sources and permissions
No matter which mobile operating system you have adopted, downloading apps from verified, trusted sources such as Google Play and Apple’s App store is always the best option to maintain your security and privacy.
However, the permissions you give an installed app are also important.
Apps can request a variety of permissions including sensor data, call logs, camera and microphone access, location, storage, and contact lists. While many legitimate apps do require access to certain features, you should always make sure you are aware of what apps can access what data to prevent unnecessary security risks or information leaks.
CCleaner, Pokemon Go, Meitu, and Uber have all come under fire for privacy-related issues in the past and the problem of data collection and extended business permissions will likely carry on in the future. Research published in January suggests that 14% of all Android apps, for example, contain contradictions in app data collection policies.
To be on the safe side, any time you no longer need an application, you should simply uninstall it.
Mobile malware
Mobile malware is far from as popular as malicious software that targets desktop machines but with these variants infecting Android, iOS, and sometimes making their way into official app repositories — such as in a recent case of Apple accidentally accepting an app containing the Shlayer malware — they are worth a mention. A common technique used by malware developers is to submit a mobile application which appears to be legitimate, and then upload malicious functions after a user base has been established.
The types of malware that can hit your mobile device are varied, from Trojans and backdoors to malicious code that focuses on the theft of valuable information, such as online banking credentials.
The most common way that such malware can infiltrate your smartphone is through the installation of malicious apps, which may actually be malware, spyware, or adware in disguise. 
It’s recommended that you download and install an antivirus software solution for your mobile device, however, you will probably be safe enough as long as you do not jailbreak your phone and you only download app .APKs from trusted sources, rather than third-party repositories.
Also: Android security: Malicious apps sneak back into Google Play | Are enterprise app users growing more security savvy? | Fleeceware apps discovered on the iOS App Store | These 17 iPhone apps have been removed from the Apple App Store for delivering malware

Secure email
Many email providers now encrypt email in transit using TLS, but there are few email services, if any, which you can truly consider 100 percent “secure” due to government laws, law enforcement powers, and the difficulty of truly implementing strong encryption in email inboxes beyond using PGP to sign messages.
However, ProtonMail is worth considering. The open-source email system is based in Switzerland and therefore protected under the country’s strict data protection laws. Emails are end-to-end encrypted which prevents ProtonMail — or law enforcement — from reading them. In addition, no personal information is required to open an account.
Another way to send emails without tracking is to use a temporary, throwaway email address. These can be generated through services including Temp Mail. 
Also: These are the 12 most common phishing email subject lines | Phishing alert: One in 61 emails in your inbox are scams | Phishing attacks: This sophisticated new group has been operating undiscovered for at least a year
Reduce your online footprint
Now that you’ve begun to take control of your devices, it is time to consider what data is floating around the internet that belongs to you — and what you can do to prevent future leaks.
One of the first places to travel to is Troy Hunt’s Have I Been Pwned service. The free search engine (of sorts) can be used to check your email accounts and linked online services for the exposure of credentials caused by data leaks. If you find you have been ‘pwned,’ stop using all the password combinations involved immediately — not only in the case of the compromised account but across the board. 
Google privacy checks
If you are a user of Google services, the Privacy Check up function can be used to stop Google from saving your search results, YouTube histories, device information, and for you to decide whether you are happy for the tech giant to tailor advertising based on your data.
Make sure you also take a look at your main Google Account to review security settings and privacy measures. The Security Check up page also shows which third-party apps have access to your account and you can revoke access as necessary.
An important feature on this page is activated if you are saving passwords in the Google Chrome browser. Google will check to see if these passwords have been compromised in a data breach, and if so, will alert you and urge you to change them immediately. To make this easier, each alert will link to the impacted domain or service so you can quickly log in and change your details. 
Also: Tired tech workers lose 27 hours of sleep per month | TechRepublic: How to use Google’s Digital Wellbeing 

Social networks
Social networks can be valuable communication tools but they can also be major sources of data leaks. It is not just friends and family that might be stalking you across social media — prospective employers or shady characters may be doing so, too, and so it is important for you to lock down your accounts to make sure only the information you want to be public, is public.
Read on: Hook, line and sinker: How I fell victim to phishing attacks – again and again
Facebook
To begin locking down your account, go to the top-right corner, click the downward arrow, and choose “Settings,” which is where the majority of your options for privacy and account safety are based.
Security and login
Under this tab, you can choose to enable 2FA protection, view the devices in which your account is actively logged on, and choose whether to receive alerts relating to unrecognized attempts to log in. If you wish, you can also nominate three to five friends who can help if you are locked out of your account.
Your Facebook information
Review activities: Under Activity Log, you can review all your activity across the social network, including posts published, messages posted to other timelines, likes, and event management. You can use the “edit” button to allow something on a timeline, hide it, or delete it outright — a handy function for wiping clean your older timeline.
Download data: Under this tab, you can choose to download all the data Facebook holds on you.
Privacy Settings and Tools: Here, you can choose who can see your future posts. For the sake of privacy, it is best to set this to friends only, unless you are happy for such content to automatically be made public.
How people can find and contact you: You can tighten up your account by also limiting who can send you friend requests, who can see your friend lists, and whether people are able to use your provided email address or phone number to find your profile. A particular feature you may want to turn off is the ability for search engines outside of the network to link to your Facebook profile.

Location: Turn off this to prevent Facebook from gathering a log of your location history.
Face recognition: Another feature you should consider turning off — it’s unnecessary.
Apps and websites: Under this tab, you can see a list of third-party services that have been logged into using your Facebook credentials and whether they are active.
Ad Preferences, advertisers: A settings option that has been heavily expanded upon since the Cambridge Analytica scandal, in this section, you can review what Facebook believes are your interests, a list of advertisers that “are running ads using a contact list that they or their partner uploaded which includes information about you,” and you can manage personalized ad settings — at least, to a point.
Your interests: If you select this tab you will see topics, such as property, finance, food, and education, which are collated based on ads or promotional material you have previously clicked on. In order to remove a topic, hover over the option and select the “X” in the top right. The same principle applies to the “Advertisers” tab.
Your information: There are two tabs here that are both relevant to your online privacy and security. The first tab, “About you,” allows you to choose whether Facebook can use your relationship status, employer, job title, or education in targeted advertising. The second tab, “Your categories,” includes automatically generated lists of topics that the social network believes are relevant for ad placement — all of which can be hovered over and removed.
Ad Settings: To further thwart targeted ads, consider saying no to all the options below.

Another section to mention is under the “About Me” tab in Facebook’s main account menu. Here, you can choose whether to make information public (whether globally or to your friends), or only available to you. This information includes your date of birth, relationship status, contact information, and where you’ve lived.
Twitter
Under the “Settings and privacy” tab there is a variety of options and changes you should implement to improve the security of your account.
Login verification: After you log in, Twitter will ask you for additional information to confirm your identity to mitigate the risk of your account from being compromised.
Password reset verification: For added security, this requires you to confirm your email or phone number while resetting your password.
Privacy and safety: You can deselect location tracking and stop your locations being posted at the same time you send out a tweet, and there is also an option for removing all past location data from published tweets in your history.
In this section, you will also come across “Personalization and data,” which allows you to control — to an extent — how the social network personalizes content, collects data, and what information is shared with third-parties. You have the option to choose not to view personalized adverts, but the main setting you need to be aware of is for sharing.
Apps and sessions: Under this tab, you can see what third-party services, if any, are connected to your account, as well as what devices your Twitter account is actively logged into.
There is also an interesting section under “Your Twitter data.” Once you have entered your password, you can see Twitter’s compiled collection of interests and advertising partners based on your activities.
It is also possible to request your full data archive under the main Settings tab.
Instagram
To give your Instagram account a privacy boost, there are a few changes you can implement.
By default, anyone can view the photos and videos on your Instagram account. By going to Settings and then Account Privacy, you can change this to ensure only those you approve of can see your content.
If your account is public, then anyone can view and comment on your images and videos. However, you can block people you would rather not interact with.
Also: Nonplussed: Why I’ll miss Google+ | Picture password: Are squiggles the future of security? | Facebook open-sources one of Instagram’s security tools
The Internet of Things
The Internet of Things (IoT) started off with mobile devices, including our smartphones, tablets, and smart watches. Now, IoT encompasses everything from smart lights to voice-controlled smart speakers and home hubs, such as Google Home and the Amazon Echo.
Here are some tips to improve the security of your connected home and prevent your products from being compromised, your information stolen, or your IoT products from being added to botnets:
Keep IoT devices password protected. Default credentials — unfortunately often still in play when it comes to IoT vendors — are an easy way for hackers to compromise a device. The first and easiest way to protect your devices is to change these credentials ASAP.
Making sure your IoT device firmware, as well as your router software, is to up-to-date is also a key factor.
Consider running all your IoT devices on a separate home network. Therefore, in the case of compromise, the damage can be limited.
If your IoT device does not require an internet connection to run, then disable it. (Unfortunately, this is rare nowadays)
If you no longer need an IoT device or have upgraded, perform a factory reset and remove older devices from your network.
Always check the default settings on new products. It may be that default options — such as the implied consent for usage data and metrics to be sent to the vendor — will benefit the vendor, but not your privacy.
Just do it
The threats to our privacy and security are ever-evolving and within a few short years, things can change for the better — or for the worse. It is a constant game of push-and-pull between governments and technology giants when the conversation turns to encryption; cyberattackers are evolving and inventing new ways to exploit us daily, and some countries would rather suppress the idea of individual privacy, rather than protect it.
In a world where many of us have been asked to rapidly change our working practices and to do our jobs from home, research suggests cyberincidents are on the rise with many of us “oblivious” to security best practices, and if we don’t take basic precautions, we may be risking not only our personal devices, but also company systems. 
Thankfully, the threat to our privacy has now been acknowledged by technology companies and many organizations, both for and non-profit, have taken it upon themselves to develop tools for our use to improve our personal security — and it is now up to us to do so. More

The global pandemic has sent 92% of organisations scurrying to adopt new technologies in order to facilitate remote work, but businesses in Asia-Pacific often come up short on cloud expertise and endpoint controls. Such common oversights can leave these companies vulnerable to cyberattacks. 
Amongst global companies that brought in new technologies to adapt to a new remote workplace, 63% turned to enterprise collaboration tools such as Zoom, Cisco Systems’ Webex, and Microsoft Teams. Another 52.1% adopted privacy tools including VPNs and encryption, while 46.9% brought in endpoint cybersecurity tools including antivirus, patch management, and vulnerability assessments, according to Acronis’ Cyber Readiness Report.
Conducted over June and July this year, the survey polled 3,400 IT managers and remote workers across 17 countries, including France, Germany, the UK, and four Asia-Pacific markets, comprising 200 respondents each from Singapore, India, Japan, and Australia.

Global pandemic opening up can of security worms
Caught by the sudden onslaught of COVID-19, most businesses lacked or had inadequate security systems in place to support remote work and now have to deal with a new reality that includes a much wider attack surface and less secured user devices.
Read More

Across the globe, 35% saw more new devices connecting to their corporate network in the past three months, while 36% reported the same number.
Amidst the increased adoption of collaboration tools, 39% said they encountered a videoconferencing attack in the past three months. Some 31% reported at least one cyber attack a day, the survey revealed. Half were targeted at least once a week, while 9% recorded at least one cyber attack every hour.
Respondents in India saw nearly twice as many attacks as any other country, followed by the US and the UAE. 
Malware attacks were identified by 22% of respondents worldwide and remained a significant issue for some countries, including Singapore, India, South Africa, UAE, and Bulgaria, where each reported nearly twice as many malware attacks as the global average. 
With employees switching to home-based work, organisations were finding it tough to manage their ICT infrastructure to support a remote workforce. Some 54.7% pointed to enabling and instructing employees on remote work as a top ICT challenge, while 49.7% cited securing remote workers as a challenge. Another 44.4% found it challenging to ensure the availability of corporate applications and networks. 
Acronis noted that these three top ICT challenges ranked significantly higher in some markets, particularly in Singapore, India, and UAE, compared to the global average figures.
Despite the increased need now to facilitate a remote workforce, organisations in Asia-Pacific still were not engaging adequate expertise in cloud technology to manage this new environment, noted Acronis CISO Kevin Reed. They also continued to deployed weak authentication and still lacked endpoint security controls, Reed told ZDNet in an email interview. 
“Unmanaged, unprotected devices get connected to the internal network and with ‘defence in depth’ strategy not being implemented, it’s easy to compromise the whole organisation,” he said.
For instance, he noted that the absence of in-built videoconferencing protection tools were amongst the key reasons companies were falling victim to videoconferencing attacks. 
With the adoption of such tools “too abrupt” due to the onslaught of the COVID-19 pandemic, he said users ignored basic security features that were available on platforms such as Zoom. Features such as password protection, waiting rooms, and authenticated access were left unactivated, he added.
Reed urged organisations to plug security loopholes left open by remote workers or unsecured home networks by implementing automated policy applications. 
“[Security] policies should not rely only on employees’ cooperation,” he said. “They should be automatically enforced whenever possible. Not only does it reduces the risk of employees violating them willingly, it also protects the company from genuine [human] mistakes.”
According to a July survey by Trend Micro, more than half of employees in Singapore had their company’s cybersecurity policies in mind whilst working remotely amidst the COVID-19 outbreak, but several still broke the rules anyway. Some 38% admitted to connecting to public Wi-Fi networks without using their corporate VPN application, while 37% uploaded corporate data on to non-work applications.
Another study by CrowdStrike in June revealed that 45% respondents across four Asia-Pacific markets — Singapore, India, Australia, and Japan — said their organisation did not provide employees with additional training on dealing with cybersecurity risks associated with working from home. In addition, 54% believed their organisations were more likely to experience a serious cyberattack during the COVID-19 pandemic than they would before the outbreak. 
RELATED COVERAGE More

There’s been a huge increase in the number of ransomware attacks over the course of 2020, with a seven-fold rise in campaigns compared with just last year alone, according to newly released data from cybersecurity researchers.
Ransomware attacks have been on the rise and getting more dangerous in recent years, with cyber criminals aiming to encrypt as much of a corporate network as possible in order to extort a bitcoin ransom in return for restoring it. A single attack can result in cyber criminals making hundreds of thousands or even millions of dollars.

More on privacy

It’s something that cyber criminals have been capitalising on despite the changing working circumstances with more people working remotely during 2020, with Bitdefender’s Mid-Year Threat Landscape Report 2020 claiming a 715% year-on-year increase in detected – and blocked – ransomware attacks.
SEE: Security Awareness and Training policy (TechRepublic Premium)
Not only has the number of ransomware attacks increased, but ransomware has continued evolving, with some of the most popular forms of ransomware last year having disappeared while new forms of ransomware have emerged. In some cases, these are even more disruptive and damaging.
“Looking into the evolution of last year’s ransomware families and how they’ve changed this year, most of them have actually gone down in numbers. This year’s popular ransomware families are not last year’s popular ransomware families,” Liviu Arsene, global cybersecurity researcher at Bitdefender told ZDNet.
For example, one of the most prolific ransomware threats during 2019 was GandCrab – until its operators shut up shop during the middle of the year, claiming to have made a fortune from campaigns.
Since then, new families of ransomware have emerged, including Sodinokibi – also known as REvil – which while not a massively prolific campaign, is a highly targeted operation that has made large amounts of money from disruptive, often high-profile ransomware attacks.
In many cases, hackers are following through with threats to leak data they’ve stolen in the run-up to deploying the ransomware attack if the victim doesn’t pay – something that might strike fear into future victims and encourage them to give into the extortion demands more quickly.
“If they do that just once, they set an example for everyone else who becomes infected, because those who don’t pay end up with data leaked and a GDPR fine. Everybody else who gets infected afterwards is going to see the attackers are serious,” Arsene explained.
While ransomware from specialist cyber-criminal gangs such as Sodinokibi and DoppelPaymer grab the headlines, ransomware-as-a-service has continued to be an issue for organisations around the world, with ransomware families like Zepto and Cryptolocker causing problems.
SEE: Cybersecurity: Four ways you can keep the hackers away
While these forms of ransomware might not be as advanced as the most high-profile versions, their availability ‘as-a-service’ allows even low-level attackers to deploy attacks in an effort to illicitly make money, often from smaller and medium-sized businesses that feel they have no other option but to pay.
Ransomware remains a major cyber threat to organisations and businesses of all kind, but there are relatively simple steps that can be taken to avoid falling victim to a ransomware attack.
Ensuring that security patches are applied as soon as possible helps prevent hackers from exploiting known vulnerabilities to gain a foothold inside the network in the first place, while organisations should also apply multi-factor authentication across the ecosystem because that can prevent hackers moving across the network by gaining additional controls.
Organisations should also regularly backup their systems, as well as testing those backups on a regular basis as past of a recovery plan, so if the worst happens and ransomware does infiltrate the network, there’s a known method of restoring it without the need to pay cyber criminals.

MORE ON CYBERSECURITY More

Apricorn Aegis Secure Key 3NXC

The
new
Aegis
Secure
Key
3NXC
builds
on
Apricorn’s
Secure
Key
3z
and
Aegis
Secure
Key
3NX,
taking
the
same
proven
form-factor
and
physical
keypad,
and
adding
something
that
users
have
… More

I’ve covered a lot of Yubico USB security keys over the years, and while the company has a fantastic range of hardware, there’s one key that people have been really desperate for over the past year or so.
A security key that combined USB-C and NFC.
Now it’s here. Introducing the YubiKey 5C NFC.
Must read: I wish my iPhone had this amazing and useful feature

While mobile-based 2FA (2-Factor Authentication) is better than nothing, it is vulnerable to attack. Hardware-based systems do away with that, and offer the best possible security for your online accounts.
The YubiKey 5C NFC can be used across a broad range of platforms — iOS, Android, Windows, macOS and Linux — and on any mobile device, laptop, or desktop computer that supports USB-C ports or NFC.
Yubico YubiKeys are compatible with a huge list of services and apps — from password managers such as LastPass and 1Password, to services such as Twitter, Login.gov, GitHub, Bitbucket, CloudFlare, AWS, Dropbox, and more. 
“The way that people work and go online is vastly different today than it was a few years ago, and especially within the last several months,” said Guido Appenzeller, Chief Product Officer, Yubico. “Users are no longer tied to just one device or service, nor do they want to be. That’s why the YubiKey 5C NFC is one of our most sought-after security keys — it’s compatible with a majority of modern-day computers and mobile phones and works well across a range of legacy and modern applications. At the end of the day, our customers crave security that ‘just works’ no matter what.”

The YubiKey 5C NFC supports multiple authentication protocols including FIDO2 and WebAuthn, FIDO U2F, PIV (smart card), OATH-HOTP and OATH-TOTP (hash-based and time-based one-time passwords), OpenPGP, YubiOTP, and challenge-response.
It works like every other YubiKey — plug it in and press the disk, or tap it — and away you go. You do need to register they key for each service you use, but I added it to my services — Google, Dropbox, Facebook, Twitter, LastPass, and a few others — in less than ten minutes.
Yubico has made it easy for enterprise customers to deploy YubiKeys by launching YubiEnterprise Services, which give customers the ability to buy security keys at scale, and even have them shipped direct to employee’s residential addresses.
The YubiKey 5C NFC is available for purchase from today and retails for $55. More