More stories

  • in

    UK Department For Education fails to meet UK, GDPR data protection standards – with flying colors

    A compulsory audit at the UK Department For Education (DFE) has exposed a quagmire of confusion and failures in managing and protecting data. 

    When a government’s “world-beating” COVID-19 test-and-trace system seems to fall at each hurdle and Excel spreadsheets are blamed for the loss of close to 16,000 confirmed coronavirus case registrations, perhaps it should not be a surprise that other departments also have data management problems.
    In 2019, the DFE was the subject of complaints stemming from the Against Borders for Children (ABC) group for apparently sharing information belonging to minors “secretly” with the Home Office. 
    At the time, as reported by The Guardian, the UK Information Commissioner’s Office (ICO) said, “DFE is failing to comply fully with its data protection obligations, primarily in the areas of transparency and accountability, where there are far-reaching issues, impacting a huge number of individuals in a variety of ways.”
    See also: ICO slams UK Met Police for failure to handle public data requests
    The department was also accused of refusing to allow parents to see their child’s record in the National Pupil Database or correct any inaccurate data by DefendDigitalMe (.PDF). 
    In light of data protection concerns and potential violations of the EU’s General Data Protection Regulation (GDPR), the ICO launched a compulsory audit into the department’s data practices. 
    The results are in and it appears the DFE has a long way to go before coming close to complying with UK protection laws. In total, 139 recommendations for improvement have been made, with over 60% classified as “urgent” or “high priority.”
    ICO
    According to the audit (.PDF), completed in February and now made public, the DFE has “no formal proactive oversight of any function of information governance, including data protection, records management, risk management, data sharing and information security […] along with a lack of formal documentation.”
    CNET: DHS found disinformation efforts mirror Trump attacks on mail-in voting, senators say
    This lack of structure means that the department cannot demonstrate GDPR compliance. In addition, the ICO notes a lack of “central oversight of data processing activities.”
    The employees at the department have also come under fire, with “internal cultural barriers and attitudes” cited as reasons for a failure on the DFE’s part to implement an “effective system of information governance.”
    There are no formal policy frameworks, the role of Data Protection Officer (DPO) has not been established properly, little training is available to employees in data protection laws, and what data itself is held by the DFE is murky — since there is no substantial record of data processing activity. 
    Othe points of note include:
    The DFE is not providing “sufficient privacy information to data subjects.”
    The DFE and internal executive agencies have shown confusion over who, or what, is a data controller, joint controller, or data processor;
    The department hasn’t shown any certainty of those who obtain data are controllers or processors — and so it is not clear on what information should be provided;
    There is a lack of awareness among staff of data protection, potentially upping the risk of data breaches;
    No experts are involved in the creation of data storage or retention record systems;
    No Data protection impact assessments (DPIAs) are being carried out at the correct and early stages of cases;
    The Privacy Assurance Team (PAT) are risk assessing projects they aren’t fully briefed on.
    TechRepublic: How to boost the effectiveness of your cybersecurity operations
    When it comes to sharing data with other organizations, the ICO notes that only 12 applications out of 400 were rejected due to an “over-reliance” on citing “public tasks” as the legal basis for the transfer of information. 
    “The ICO’s primary responsibility is to ensure compliance with the law and its policy is to work alongside organizations committed to making the necessary changes to improve data protection practice,” the ICO said in a statement. “The department accepted all the audit recommendations and is making the necessary changes.”
    “We treat the handling of personal data — particularly data relating to schools and other education settings — extremely seriously and we thank the ICO for its report which will help us further improve in this area,” a DFE spokesperson told ZDNet. “Since the ICO completed its audit, we’ve taken a number of steps to address the findings and recommendations, including a review of all processes for the use of personal data and significantly increasing the number of staff dedicated to the effective management of it.”
    Furthermore, the department says that training plans have now been created for staff and internal vacancies related to data management have been “vastly increased” over the last year, the majority of which have now been filled. 
    Previous and related coverage
    Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

  • in

    Hackers exploit Windows Error Reporting service in new fileless attack

    A new fileless attack technique that abuses the Microsoft Windows Error Reporting (WER) service is the work of a hacking group that is yet to be identified. 

    According to Malwarebytes security researchers Hossein Jazi and Jérôme Segura, the attack vector relies on malware burying itself in WER-based executables to avoid arousing suspicion.
    In a blog post on Tuesday, the duo said the new “Kraken” attack — albeit not a completely novel technique in itself — was detected on September 17. 
    See also: Researchers track hacking ‘fingerprints,’ link Russian attackers to Windows exploit sellers
    A lure phishing document found by the team was packaged up in a .ZIP file. Titled, “Compensation manual.doc,” the file claims to contain information relating to worker compensation rights, but when opened, is able to trigger a malicious macro. 
    The macro uses a custom version of the CactusTorch VBA module to spring a fileless attack, made possible through shellcode. 
    CactusTorch is able to load a .Net compiled binary called “Kraken.dll” into memory and execute it via VBScript. This payload injects an embedded shellcode into WerFault.exe, a process connected to the WER service and used by Microsoft to track and address operating system errors.
    “That reporting service, WerFault.exe, is usually invoked when an error related to the operating system, Windows features, or applications happens,” Malwarebytes says. “When victims see WerFault.exe running on their machine, they probably assume that some error happened, while in this case they have actually been targeted in an attack.”
    CNET: Amazon doubles down on Echo home security. What to know
    This technique is also used by NetWire Remote Access Trojan (RAT) and the cryptocurrency-stealing Cerber ransomware. 
    The shellcode is also commanded to make an HTTP request to a hard-coded domain, likely to download additional malware. 
    Operators of Kraken follow up with several anti-analysis methods, including code obfuscation, forcing the DLL to operate in multiple threads, checking for sandbox or debugger environments, and scanning the registry to see if VMWare’s virtual machines or Oracle’s VirtualBox are running. The developers have programmed the malicious code to terminate if indicators are found of analysis activities. 
    TechRepublic: How to boost the effectiveness of your cybersecurity operations
    The Kraken attack has proven to be difficult to attribute, at present. The hard-coded target URL of the malware was taken down at the time of analysis, and without this, clear markers indicating one APT or another are not possible. 
    However, Malwarebytes says there are some elements that reminded researchers of APT32, also known as OceanLotus, a Vietnamese APT believed to be responsible for attacks against BMW and Hyundai in 2019. 

    Previous and related coverage
    Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

  • in

    GitLab patches Elasticsearch private group data leak bug

    A bug bounty researcher has been awarded $3000 for disclosing a security issue in GitLab leading to the exposure of private groups. 

    The report was made public on the HackerOne bug bounty platform on October 6. 
    Submitted by researcher Riccardo “rpadovani” Padovani on November 29, 2019, the GitLab issue is described as a failure to remove code from Elasticsearch API search results when transferring a public group to a private group. 
    Padovani said the medium-severity issue occurs when a project handler shifts a public group — with public projects — to private status. This should also mean that the code and wiki associated with the project should be locked down, but the security flaw ensured that this data could still be reached through search APIs. 
    CNET: Amazon doubles down on Echo home security. What to know
    The bug bounty hunter described a scenario in which the improper access issue could be triggered:

    “Alice creates the public group “Example”, and a public project named “Example-project” inside the group. In the readme of the project, Alice writes “Example”.
    Now, Alice creates a private group called “private”, and transfer all the “Example” group to the “private” group. If Bob (totally unrelated to Alice) searches for “Example” instance-wide, he will not find anything [… but if he] uses APIs, he will receive the results back with the information that should be private.”

    This also happens with wiki_blobs functionality. However, it is worth noting that the problem only occurs when transferring groups, rather than single projects. 
    TechRepublic: How to boost the effectiveness of your cybersecurity operations
    GitLab triaged and accepted the report, awarding a bounty of $3000. A patch was issued in GitLab version 12.5.4. 
    In April, the dev-ops platform awarded William Bowling $20,000 for disclosing a remote code execution (RCE) vulnerability. In March, the researcher made GitLab aware of critical validation issues in the Gitlab UploadsRewriter function which could be exploited to trigger a path traversal scenario, leading to RCE. 

    Previous and related coverage
    Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

  • in

    ZeroFOX acquires Cyveillance threat intelligence business from LookingGlass

    ZeroFOX has acquired LookingGlass Cyber Solutions’ Cyveillance threat intelligence business. 

    Announced on Tuesday, the deal is designed to merge the ZeroFOX Digital Risk Protection Platform and Cyveillance’s threat intelligence data trove and dark web intelligence capabilities. 
    ZeroFOX says that snapping up the business, previously a subsidiary of LookingGlass, is a strategic move to push the company up the enterprise threat intelligence and protection roster on a global scale.
    See also: Leaders of ‘notorious’ Team Xecuter game piracy, homebrew group arrested
    Financial details were not disclosed. 
    Founded in 1997 and headquartered in Reston, Virginia, Cyveillance was previously acquired by LookingGlass in 2015. 
    The company provides clients with online data source analysis and monitoring, including a digital risk protection service, a “data lake” repository containing over two decades’ worth of threat intelligence, open source security projects, as well as investigation and forensics offerings.
    “Our merger with the Cyveillance team fulfills our strategic vision of accelerating our position as the definitive worldwide leader in Digital Risk Protection,” said James Foster, ZeroFOX CEO. 
    CNET: Amazon doubles down on Echo home security. What to know
    Once the merger completes, Gilman Louie, Executive Chairman of LookingGlass, will be joining the ZeroFOX board of directors. 
    Existing Cyveillance customers will continue to receive their services as normal and will also be offered access to ZeroFOX solutions. 
    “To accelerate the innovation and service delivery for organizations worldwide who depend on us to protect their critical assets, data and accounts on public platforms, we are employing acquisitions as multipliers in our go-forward strategy,” ZeroFOX added. 
    The purchase of Cyveillance is ZeroFOX’s first acquisition since its founding in 2013. The company has previously raised over $154 million through multiple investment rounds. 
    TechRepublic: How to boost the effectiveness of your cybersecurity operations
    Last week, Imperva acquired database security firm jSonar. While financial details were not made public, the cybersecurity firm said that technology developed by jSonar would be valuable in improving on-premise, cloud, hybrid, and Database-as-a-Service (DBaaS) solutions in its portfolio. 

    Previous and related coverage
    Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

  • in

    Budget 2020: Australia's cyber dollars are full of stale hot air

    Australian Prime Minister Scott Morrison
    Image: IBM
    Australia’s federal budget papers, which dropped on Tuesday night, make it clear just how little attention the government is paying to its cyber policies and to good governance generally.
    ZDNet has already reported how most of the Budget was pre-announced, with those previously-announced figures included in the totals of supposedly new spending. In reality, though, it’s even worse.
    Yes, the “additional $201.5 million” to help deliver the nation’s disappointing Cyber Security Strategy is just another part of the AU$1.7 billion over 10 years already announced in August.
    Yes, the vast majority of that total figure is the AU$1.35 billion cyber kitty for the Cyber Enhanced Situational Awareness and Response (CESAR) package already announced with much fanfare back in June.
    Yes, it’s a re-announcement of a re-announcement. New is not new.
    But look more closely and you’ll see that CESAR isn’t even an additional investment.
    “This measure will be offset by redirecting funding within the Defence Portfolio,” says Budget Paper No. 2.
    To be fair, CESAR was something that would’ve been built anyway. Eventually. Probably. It was just given a shiny name to become part of a Scott Morrison prime ministerial announceable. New is not new.
    Even this is a cyber throwback, according to Labor’s Shadow Assistant Minister for Communications and Cybersecurity.
    “This government first announced funding for an ASD [Australian Signals Directorate] threat sharing platform in the 2016-17 Budget,” Shadow Assistant Minister for Communications and Cybersecurity Tim Watts tweeted.
    “But you know, ANNOUNCING and DELIVERING are different things for this government. Still not delivered yet.”
    And all of this is spread “over 10 years”, or three election cycles. The Cyber Security Strategy still doesn’t specify a target date for any of this happening.
    According to Home Affairs’ Portfolio Budget Statements, that would be too hard.
    “Due to the ongoing nature of the program, it is not appropriate to set an expected date of achievement,” it wrote.
    I guess that’s true, given that the strategy itself has so very few measurable targets.

    Performance targets for the Department of Home Affairs program number 1.8 Cyber Security.
    Some AU$$37.7 million of the magic and largely mythical AU$1.7 billion goes to the Department of Industry, Science, Energy and Resources to “support industry and academia to develop innovative approaches to improve cybersecurity skills and long-term workforce planning”.
    This is all well and good, but it comes from the renamed “Election Commitment — Cyber Security Resilience and Workforce Package” that was part of the Mid-Year Financial and Economic Outlook Statement from months ago.
    The AU$19.1 million for the Department of Home Affairs to “undertake a range of initiatives, including expanding outreach to Australian industry on cybersecurity-related matters, providing support services to victims of identity theft and cybercrime and enhancing cybersecurity awareness among households and small businesses” is partially money that was already allocated to the department. New is not new.
    The AU$1.6 million to the Commonwealth Ombudsman, intended to monitor the nation’s controversial encryption legislation and other cybercrime law enforcement powers, is only for the current financial year. The money comes from “redirecting funding”, a delightful euphemism, from the Department of Home Affairs.
    What happens in 2021-2020? The Ombudsman will presumably have to beg for more, or the Telecommunications and Other Legislation Amendment (Assistance and Access) Act 2018 will go without proper independent oversight.
    Admittedly, the Parliamentary Joint Committee on Intelligence and Security’s review of the Act is due to report any day now, so maybe the government is holding off allocating money until then. Yes, I’m sure that’s it.
    Given the government’s poor track record with IT projects more broadly, you might think that it’d be eager to make sure future projects stay on track.
    As Crikey’s Bernard Keane wrote recently, the Australian National Audit Office (ANAO) has been instrumental in uncovering widespread bureaucratic failure, especially when it comes to IT and cybersecurity.
    But no. ANAO’s funding is actually being cut from AU$112 million in 2019-2020 to AU$98 million in 2020-2021.
    One of the few properly new items is AU$39.4 million to the Office of the eSafety Commissioner to cover the increasing demand for its services and, among other things, a new “adult cyber abuse takedown scheme” under the new Online Safety Act.
    That’s good, but that law doesn’t even exist yet. There’s isn’t a draft Bill.
    The more you dig into Budget 2020, the less actual substance there is to find, which is the perfect summary of the Morrison government.

    Australian Budget 2020 More

  • in

    US antitrust probe finds 'alarming pattern' of innovation-stifling practices

    The United States House Judiciary Antitrust Subcommittee has wrapped up its probe into Amazon, Facebook, Apple, and Google, with its 450-page report [PDF], making a slate of recommendations, including those it said would strengthen antitrust laws and restore competition in the digital economy.
    “As they exist today, Apple, Amazon, Google, and Facebook each possess significant market power over large swaths of our economy,” Judiciary Subcommittee Chairman Jerrold Nadler (D-NY) and Antitrust Subcommittee Chairman David N. Cicilline (D-RI) said in a statement.
    “In recent years, each company has expanded and exploited their power of the marketplace in anticompetitive ways.
    “Our investigation leaves no doubt that there is a clear and compelling need for Congress and the antitrust enforcement agencies to take action that restores competition, improves innovation, and safeguards our democracy.”
    The subcommittee kicked off its inquiries over 16 months ago. Democrat Congresswoman Pramila Jayapal (D-WA) said investigations led the subcommittee to the conclusion that self-regulation by Big Tech comes at the expense of communities, small businesses, consumers, the free press, and innovation.
    “Our investigation revealed an alarming pattern of business practices that degrade competition and stifle innovation,” Congresswoman Val Demings (D-FL) added.
    “These companies have made remarkable advancements that have shaped our markets and our culture, but their anticompetitive acts have come at a cost … competition must reward the best idea, not the biggest corporate account.”
    Although not agreeing on who was to blame for allowing “Big Tech” to achieve near-monopoly status, Congressman Matt Gaetz (R-FL) agreed that these “predatory companies” have used their vast size to unfairly harm competition and consumers.  
    On Facebook, the subcommittee said it found evidence of “monopolisation and monopoly power” in the social networking market. It also said that of its nearly-100 acquisitions, the Federal Trade Commission engaged in an extensive investigation of just one — Instagram in 2012.
    The subcommittee said a senior Facebook executive described its acquisition strategy as a “land grab” to “shore up” Facebook’s position and another said the company purchased Instagram because it was a threat to Facebook.
    “The online platforms’ dominance carries significant costs. It has diminished consumer choice, eroded innovation and entrepreneurship in the US economy, weakened the vibrancy of the free and diverse press, and undermined Americans’ privacy,” the report reads.
    The report says Facebook has also maintained its monopoly through a series of anticompetitive business practices, using its data advantage to create “superior market intelligence to identify nascent competitive threats and then acquire, copy, or kill these firms”.
    “In the absence of competition, Facebook’s quality has deteriorated over time, resulting in worse privacy protections for its users and a dramatic rise in misinformation on its platform,” it continues.
    Google also holds a monopoly, the report says, with search dominance “protected by high entry barriers”, with the subcommittee determining “Google maintained its monopoly over general search through a series of anticompetitive tactics”.
    Such anticompetitive tactics, the report lists, include contractual restrictions and exclusivity provisions to extend Google’s search monopoly, such as in the case of its 2005 purchase of the Android operating system.
    “Google exploits information asymmetries and closely tracks real-time data across markets, which — given Google’s scale — provide it with near-perfect market intelligence,” the report says. “In certain instances, Google has covertly set up programs to more closely track its potential and actual competitors, including through projects like Android Lockbox.
    “Each of its services provides Google with a trove of user data, reinforcing its dominance across markets and driving greater monetisation through online ads. Through linking these services together, Google increasingly functions as an ecosystem of interlocking monopolies.”
    Although Amazon is considered as controlling about 40% of US online retail sales, the subcommittee said it was sure the company’s market share is likely understated and alleges that estimates of about 50% or higher were more credible.
    “The platform has monopoly power over many small- and medium-sized businesses that do not have a viable alternative to Amazon for reaching online consumers,” the report says. “Amazon has 2.3 million active third-party sellers on its marketplace worldwide, and a recent survey estimates that about 37% of them — about 850,000 sellers — rely on Amazon as their sole source of income.”
    “Amazon achieved its current dominant position, in part, through acquiring its competitors; it has also acquired companies that operate in adjacent markets, adding customer data to its stockpile and “further shoring up its competitive moats”, the subcommittee wrote.
    “Amazon has engaged in extensive anticompetitive conduct in its treatment of third-party sellers,” it said. “Publicly, Amazon describes third-party sellers as ‘partners’. But internal documents show that, behind closed doors, the company refers to them as ‘internal competitors’.”
    On the voice assistant side, the report says the company’s “early leadership” in this market is leading to the collection of highly sensitive consumer data, which Amazon can use to promote its other business, including e-commerce and Prime Video.
    And on the company’s cloud business, the subcommittee said as AWS provides critical infrastructure for many businesses with which Amazon competes, such a scenario creates the potential for a conflict of interest where cloud customers are “forced to consider patronising a competitor, as opposed to selecting the best technology for their business”.
    Apple, meanwhile, “exerts monopoly power in the mobile app store market”, controlling access to more than 100 million iPhones and iPads in the United States.
    “Apple leverages its control of iOS and the App Store to create and enforce barriers to competition and discriminate against and exclude rivals while preferencing its own offerings,” the subcommittee determined. “Apple also uses its power to exploit app developers through misappropriation of competitively sensitive information and to charge app developers supra-competitive prices within the App Store.
    “In the absence of competition, Apple’s monopoly power over software distribution to iOS devices has resulted in harms to competitors and competition, reducing quality and innovation among app developers, and increasing prices and reducing choices for consumers.”
    Not citing any one company in particular, the subcommittee said the rise of market power online has also materially weakened innovation and entrepreneurship in the US economy.
    “Additionally, in the absence of adequate privacy guardrails in the United States, the persistent collection and misuse of consumer data is an indicator of market power online,” it wrote.
    “Online platforms rarely charge consumers a monetary price — products appear to be ‘free’ but are monetised through people’s attention or with their data. In the absence of genuine competitive threats, dominant firms offer fewer privacy protections than they otherwise would, and the quality of these services has deteriorated over time.”
    The subcommittee also said the market power of the dominant platforms risks “undermining both political and economic liberties”.
    The subcommittee offered a number of recommendations to Congress: Restoring competition in the digital economy, strengthening the antitrust laws, and reviving antitrust enforcement.
    The first batch of reforms would enforce “structural separations” and prohibit certain dominant platforms from operating in adjacent lines of business; introduce non-discrimination requirements, which would prohibit dominant platforms from engaging in self-preferencing, and require them to offer equal terms for equal products and services; require dominant platforms to make their services compatible with various networks and to make content and information easily portable between them; “presumptive prohibition” against future mergers and acquisitions; introduce safe harbour for news publishers; and introduce prohibitions on “abuses of superior bargaining power”.
    To strengthen antitrust laws, the subcommittee wants to reassert the anti-monopoly goals of the antitrust laws and their centrality to ensuring a “healthy and vibrant democracy”.
    Specifically, it wants improvements to the Clayton Act, the Sherman Act, and the Federal Trade Commission Act, in order to bring these laws in line with the challenges of the digital economy.
    The subcommittee said it wants to restore “robust congressional oversight of the antitrust laws and their enforcement” and restore the federal antitrust agencies to full strength, by triggering civil penalties and other relief for “unfair methods of competition” rules.
    Such restoration, the report explains, would require the Federal Trade Commission to engage in regular data collection and enhance public transparency and accountability. The subcommittee highlighted the FTC and the Antitrust Division should also be handed further funding.
    The subcommittee’s final recommendation was to strengthen private enforcement, through eliminating obstacles such as forced arbitration clauses, limits on class action formation, judicially created standards constraining what constitutes an antitrust injury, and unduly high pleading standards.
    Congressman Ken Buck (R-CO) said that while he does not support the recommendations made, he fully supports working towards a solution that “reins in Big Tech and their anticompetitive behaviour”.
    “Antitrust enforcement in Big Tech markets is not a partisan issue, I support the ongoing, bipartisan investigations of these companies. But an ounce of prevention is worth a pound of cure — I would rather see targeted antitrust enforcement over onerous and burdensome regulation that kills industry innovation,” Buck said. 
    In response to the subcommittee’s report, Google said the goal of antitrust law is to protect consumers, not help commercial rivals.
    “Americans simply don’t want Congress to break Google’s products or harm the free services they use  every day,” the search giant wrote. 
    “Many of the proposals bandied about in today’s reports — whether breaking up companies or undercutting Section 230 — would cause real harm to consumers, America’s technology leadership, and the US economy — all for no clear gain.”
    At the time of publication, Amazon, Apple, and Facebook were yet to publish responses to the Investigation of Competition in Digital Markets report.
    RELATED COVERAGE More

  • in

    New HEH botnet can wipe routers and IoT devices

    Image: Netlab

    A newly discovered botnet contains code that can wipe all data from infected systems, such as routers, servers, and Internet of Things (IoT) devices.
    Named HEH, the botnet spreads by launching brute-force attacks against any internet-connected system that has its SSH ports (23 and 2323) exposed online.
    If the device uses default or easy-to-guess SSH credentials, the botnet gains access to the system, where it immediately downloads one of seven binaries that install the HEH malware.
    This HEH malware doesn’t contain any offensive features, such as the ability to launch DDoS attacks, the ability to install crypto-miners, or code to run proxies and relay traffic for bad actors.
    The only features present are a function that ensnares infected devices and coerces them to perform SSH brute-force attacks across the internet to help amplify the botnet; a feature that lets attackers run Shell commands on the infected device; and a variation of this second feature that executes a list of predefined Shell operations that wipe all the device’s partitions.
    Botnet is in its early stages of development
    HEH was discovered by security researchers from Netlab, the network security division of Chinese tech giant Qihoo 360, and detailed for the first time in a report published today.
    Because this is a relatively new botnet, Netlab researchers can’t tell if the device-wiping operation is intentional or if it’s just a poorly coded self-destruction routine.
    But regardless of its purpose, if this feature ever gets triggered, it could result in hundreds or thousands of bricked and non-functioning devices.
    This could include home routers, Internet of Things (IoT) smart devices, and even Linux servers. The botnet can infect anything with a weakly-secured SSH ports, even Windows systems, but the HEH malware only works on *NIX platforms.
    Since wiping all partitions also wipes the device’s firmware or operating system, this operation has the potential to temporarily brick devices — until their firmware or operating systems are reinstalled.
    However, in some cases, this could mean permanently bricked systems, as some device owners may not have the knowledge to reinstall firmware on their IoT equipment and may just choose to throw away the old and buy a new device instead.
    Currently, Netlab said it detected HEH samples that can run on the following CPU architectures x86(32/64), ARM(32/64), MIPS(MIPS32/MIPS-III) and PPC.
    The botnet is still spreading.
    HEH, while it hasn’t bricked any devices yet, wouldn’t be the first botnet that wipes IoT devices. The first two were BirckerBot and Silex. More

  • in

    Chrome 86 released with password-related security improvements

    Image: Google
    Google has released Chrome 86 today to the stable channel, and this new release includes numerous security enhancements and new APIs for developers.
    Each new Chrome release usually focuses on a main theme. For example, Chrome 84 focused on UI overhauls, while Chrome 85 focused on speed and API improvements.
    On that tune, Chrome’s new v86 release comes with loads of password and security-related upgrades, but also with several deprecations and new APIs also included under the hood as well.
    Password-checking feature coming to mobile
    In December 2019, with Chrome 79, Google added a feature to Chrome named Password Checkup that would take the user’s synced passwords and check to see if they’ve been leaked online during data breaches at other companies.
    With Chrome 86, Google says this feature (known as Safety Check since May 2020) is now coming to mobile versions of Chrome on Android and iOS.

    Image: Google [supplied]
    Easier to change compromised passwords
    Furthermore, Safety Check itself is also getting updates. Starting with Chrome 86, Safety Check supports the “.well-known/change-password” standard.
    This is a W3C standard that allows websites to specify the URL where users can go to change their passwords.
    Chrome 86 adding support for this standard means that users can press a button in the Chrome password settings screen and go directly to that page and change the password right away, rather than search blindly through a website’s complicated structure.
    Biometric authentication for password filling on iOS
    Google is also expanding the touch-to-fill feature on iOS. Originally launched on Android in July, this feature works by detecting the site the user is navigating on and then prompting the user to autofill passwords, if credentials are recorded.
    The feature was created to prevent users from autofilling passwords on phishing sites, but it also lets users fill in passwords in login forms with the touch of a finger, without having to scroll through tens or hundreds or entries to select the proper credentials to auto-fill.
    Starting with Chrome 86, this new feature is also present on iOS, where as an additional security feature, users will also be asked to authenticate via a biometric before auto-filling passwords. This includes using Face ID, Touch ID, or their phone passcode as a last resort.

    Image: Google
    Enhanced Safe Browsing coming to mob
    Enhanced Safe Browsing, a security feature that provides increased phishing and malware detection, is being expanded to mobile versions of Chrome.
    The feature made its debut in Chrome 83, in May 2020, but only for desktop versions.

    Image: ZDNet
    Warnings on insecure forms
    Chrome 86 now also shows warnings when entering data inside “insecure forms.”
    By “insecure forms,” Google is referring to forms hosted on encrypted HTTPS pages but which secretly submit their data via non-encrypted HTTP operations.

    Image: Google
    Warnings on insecure downloads
    Google is also continuing its plan on showing warnings when downloading files via HTTP from pages that show HTTPS.
    In Chrome 86, executable and archive files are blocked by default, while Chrome shows warnings for office-related document downloads.

    Image: ZDNet
    Start of the FTP deprecation
    Chrome 86 is also the first version in Google’s grand master plan to remove support for FTP links from Chrome. The entire timeline is below:
    Chrome 86 – FTP is still enabled by default for most users, but turned off for pre-release channels (Canary and Beta) and will be experimentally turned off for one percent of stable users. In this version you can re-enable it from the command line using either the –enable-ftp command line flag or the –enable-features=FtpProtocol flag.
    Chrome 87 – FTP support will be disabled by default for fifty percent of users but can be enabled using the flags listed above.
    Chrome 88 – FTP support will be disabled.
    New Native File System
    The new Native File System API is a new developer tool that Google tested in previous versions of Chrome and has activated by default in Chrome 86.
    This new API enables developers to build powerful web apps that interact with files on the user’s local device. The new API is hidden behind a permission prompt to prevent websites from accessing any local files without authorization.
    However, after a user grants the browser access, this API allows a website to behave like a locally installed app and save and interact with designated files and folders on the user’s device.
    Google expects this new API to be used to build interactive web apps such as IDEs, photo and video editors, text editors, and more.
    But we only touched on the major Chrome 86 features. Users who’d like to learn more about the other features added or removed in this new Chrome release can check out the following links for more information:
    Chrome security updates are detailed here [not yet live].
    Chromium open-source browser changes are detailed here.
    Chrome developer API deprecations and feature removals are listed here.
    Chrome for Android updates are detailed here [not yet live].
    Chrome for iOS updates are detailed here.
    Changes to Chrome V8 JavaScript engine are available here.
    Changes to Chrome’s DevTools are listed here.
    [embedded content] More