Category Archives: Blog

Posted on Author Atlantic Computer Services Categories Blog

Many IOT Devices At Risk Due To DNS Vulnerability

How many “smart” devices do you have connected to your home or company network?  It’s probably a higher number than you originally estimated.  However large that number is, it pays to be aware that IoT devices are some of the least secure devices available on the market today, which makes them the weakest link in terms of hackers successfully attacking your network.

In fact, there are millions of IoT devices that are vulnerable to a critical security flaw residing in the DNS component of a C Standard library that all sorts of firmware developers make use of.  That means that right now, there are literally millions of ticking time bombs out there and one or more of them could be connected to your network.

There are two libraries to be aware of here:  uClibc and its fork, developed by the OpenWRT team.  You’ll find major companies like Linksys, Axis, and Netgear making use of both on a regular basis, and you’ll even find it in some Linux distributions.

Unfortunately, at the time this article was written, there are no fixes available from the developer which leaves the products of more than 200 different vendors at risk.

Essentially, the flaw relies on a predictable transaction ID for DNS lookup requests.  It is that predictability that creates the vulnerability and allows a clever hacker to “trick” a vulnerable device into pointing to an arbitrarily defined end point specified by the hacker, which would have the effect of rerouting your network traffic to a server under the control of the hackers.

As you can imagine, that would cause no end of trouble for you and your company. That is because the hackers would then have perfect visibility into everything you do on your network and would be able to inject any sort of malware into any system on your network.

There’s no simple solution here except to disconnect any vulnerable IoT devices from your network and contact the developers who maintain the library and demand immediate action.  A fix is currently in the works, but adding your voice to the rapidly growing chorus can’t hurt.

0
Posted on Author Atlantic Computer Services Categories Blog

Users Without Internet Explorer Updates Are Vulnerable To Malware

Researchers at Bitdefender have discovered a new malware campaign.  This one uses an attack method that has fallen out of favor in recent months, called the Exploit Kit.

Exploit Kits used to be all the rage. Flash Player was a popular target for Exploit Kit based attacks but it is now a thing of the past. Therefore, the popularity of the Exploit Kit has declined markedly.

Someone is apparently trying to give it a comeback, however. It has been made possible by the fact that there are a growing number of users on the internet who don’t prioritize updating their browser software. Notably, the users still relying on Internet Explorer are particularly vulnerable since it is no longer receiving security updates.

The latest campaign has been dubbed RIG EK. It exploits CVE-2021026411 which is a flaw in Internet Explorer that causes memory corruption when visiting a specially crafted website.  Once the group has a victim on the hook, they deploy a malware strain called RedLine which is an inexpensive but quite powerful infostealer. It is especially popular on Russian-speaking hacking forums.

Once RedLine is installed, the hackers will exfiltrate all the data they can from the victim’s device, focusing on stored payment card information, cryptocurrency wallet information, and other high value data.

The RIG EK campaign doesn’t really do anything new. However, the hackers behind it have found new ways to breathe life into older techniques that had become rarely seen on the threat landscape, and that makes it a genuine threat.

If your organization hasn’t historically prioritized browser updates, this might be a good time to consider changing that policy. If you’re still using Internet Explorer for one reason or another, it’s past time to apply some resources to the task of transitioning away from it. Even if for no other reason than to give yourself a few less headaches.

0
Posted on Author Atlantic Computer Services Categories Blog

Google Assistant Tool Will Automate Password Changes

A handy new Google Assistant is coming soon to a device near you.  The new feature is designed to automate the frustrating and often time-consuming task of changing your passwords after a breach.

This information is according to a tweet from Max Weinbach and a separate report from a group called the Android Police.

Google has already implemented a powerful tool to detect when users are making use of passwords that have been compromised in a breach.  This new feature will build on that. Based on screenshots captured by Weinbach, you’ll soon see a new “Change Password Automatically” button when you investigate which of your passwords have been compromised.

The company announced the feature last year during Google I/O and it does have a few caveats. The biggest is that it only works on supported sites, but given that Google is behind it, it’s hard to imagine a scenario in which the majority of sites on the web didn’t flock to support the new feature.

When you use the new feature, the Assistant will automatically display the appropriate web page for changing one’s password on a supported site. Then Chrome’s built-in password manager will take over, automatically generating a new password, then storing the new login details without any input needed from the user.

This is fantastic news indeed. We love the fact that Google is working on this while simultaneously working with Apple and Microsoft to eventually get rid of passwords altogether. All this is in preference for a much more secure FIDO passkey.

That effort to get rid of passwords is still at least a year away. This one will be rolled out in just a few months.  As such, it will be a great intermediate step designed to keep users safer until a more robust and permanent solution can be rolled out.  Kudos to Google for their hard work on this front!

0
Posted on Author Atlantic Computer Services Categories Blog

 Amazon Kindle Will Soon Support ePub Standard Files

Do you own an Amazon Kindle?  If so, you’re probably already aware of one of the major frustrations with the product.  Kindles are amazing but they don’t support the epub file format. Of course, epub is  the format that just about everybody else on the planet other than Amazon sells e-books in.

The company has managed to avoid supporting the epub format for more than fifteen years.

If that has been a sticking point for you, there’s good news – sort of.  Kindle will soon be “supporting” the epub format!

We say sort of, and use “supporting” in quotes because although it would be easy for the company to simply enable their ubiquitous readers to support epub, that’s not actually what the company has planned.  Instead, Amazon will issue an update to Kindles that will allow them to convert epub files to a proprietary format that can be read by their readers.

Kindle users have gotten by for the past fifteen years by using a program called Calibre, which has a somewhat convoluted routine that converts epub files into the Kindle’s native file format.  The results were sometimes not great, but it got the job done.  Even so, it has proved to be intensely frustrating for Kindle users who have complained loudly to Amazon, but to no avail.

Now, finally, Amazon is listening – again, sort of.

Early user reactions to Amazon’s announcement have not been favorable, but the company continues to show absolutely zero interest in genuinely supporting the epub format.

In some respects, it’s easy to understand Amazon’s position. The truth is that at this point, they’re likely alienating enough people with their hardline position against the epub format that they’re not doing themselves any favors.

At any rate, if you own a Kindle you’ll soon be able to convert epub files to something called KF8 and view them on your device.  It’s not a great solution but it’s an improvement over what exists today.

0
Posted on Author Atlantic Computer Services Categories Blog

Google Soon Informing Users About What Data Apps Collect

A small but important change is coming to your Android apps.  Soon you’ll notice a new Data Safety section on the Google Play Store which will provide greater transparency about exactly what data the apps you install are collecting.

The change is meant to serve as a “privacy label” that will allow users to evaluate the data an app will collect on them before they install it, so they can make better and more informed decisions about what to install.

In addition to requiring developers to disclose exactly what data they ‘re collecting, they will also have to disclose what data they will share with third parties. That essentially forces development teams to disclose the purpose behind the collection.

The new feature will also give users access to more than just the high-level view.  For additional details, they’ll be able to click on any given data category to find out the particulars involved.

That sounds amazing but believe it or not, there’s more.  The third leg of the new Data Safety section will include details about the app’s security practices, outlining what specific mechanisms the developers use to protect and safeguard collected data.  Here, users will also be able to see if they’re given the option to ask for the deletion of their collected data at any time.

On top of that, the new Data Safety section will specify if the app in question adheres to the Google Play Families Policy which is aimed squarely at protecting children.

Google is taking a careful and measured approach to the rollout. So if you have an Android device, don’t expect that you’ll start seeing details in the Data Safety section right away. It will happen over the next few weeks. It will appear and then get increasingly fleshed out.

As of now, app Developers can begin declaring how collected data is used and they have until July 20th of this year (2022) to complete their submissions.

These are fantastic changes.  Kudos to Google for this.  Great news indeed.

0
1 … 31 32 33 34 35 … 236