In the Know - Cyber Security Update - Aftermath of Equifax Part 2

Posted by Eric Brown on Sep 18, 2017 1:23:16 PM

This week we learned:
1.    The Equifax breach was indeed the result of an unmitigated known security vulnerability in the Apache Struts 2 web application service discovered in March 2017 Apache Struts CVE-2017-5638.
2.    Security researchers exposed an additional database in Argentina protected with the credentials of admin/admin.  Equifax claims that this database had not been used since 2013 which leads one to question what other databases were left exposed to the internet with easily guessable passwords.  
3.    Two executives have “retired” and the CEO will be facing a congressional inquiry on October 3rd.

In last week’s article we focused on tackling the immediate steps to take charge of your own credit.  If you haven’t had a chance to freeze and review your credit and change your logins and passwords please consider doing so.  Keep track of all of your receipts and expenses related to the breach, as there will be opportunities to participate in a variety of lawsuits, especially if your identity was stolen as a result of Equifax’s negligence.  There’s also the opportunity to take a short position through put options or a straight short sale, if that interests you.  The stock has moved 50 points down in the last 2 weeks and some speculate that it still has further to go.

This week the focus will expand to include ways to protect your overall identity and take back control over what information companies have about you.  Recent legislation allows ISP’s (Internet Service provider) to get into the data mining business and collect information about your browsing history, geo location, and online activity.

Three things you can do to protect  your browsing.
1.    Use a VPN (virtual private network) service that doesn’t log your data.  For a few dollars a month you can set up a VPN service, creating a virtual encrypted network tunnel between your computer and the VPN service provider.  Since all Internet traffic will be coming from the network you connect to at the end of the tunnel, your ISP will be blind to your surfing activities.  VPNs are a must have for people who connect to public wifi connections in coffee shops, libraries, etc.
2.    Use a tor browser:  Tor obfuscates your traffic by sending it through a free relay network which helps to conceal location and browsing information from anyone conducting network surveillance, including your ISP.  https://www.torproject.org/

3.    Make sure the sites you browse leverage HTTPS instead of HTTP.  HTTPS traffic is encrypted, and while your ISP can see the site that you visit (unless using a VPN or tor browser) it won’t be able to see and record as much of what you are doing on the site.

4.    Use a web browser that has built in tracking prevention and/or install 3rd party extensions such as Ghostery, Ad Block, uBlock Origin or Privacy Badger.  Reminder:  Some sites rely on ad revenue to survive.  Consider white listing the sites you frequent, and those sites that promise an ad-light experience.
Write up on new Safari tracking prevention:
https://www.blog.michiganfreelisting.com/apple-addresses-ad-industry-complaints-safari-tracking-prevention-feature/

Secure Email – Setup time 10 minutes.  Cost:  free or a small monthly fee.
All of the free email providers (Yahoo! (Verizon), Gmail, Hotmail (Microsoft)) and many of the paid providers (Comcast, other ISPs, etc.) scrub your email for content and sell metadata about you.  All of the major social media providers (Facebook, Twitter, Instagram, Snapchat) also collect and store information about you, not only is this information available for sale in metadata form, it’s also available to the federal government.

The PRISIM program allows for the collection of Internet communications from at least nine Internet companies.  The data collected includes E-mail, Chat (video & voice), Videos, Photos, Stored data,  VoIP, File Transfers, Video Conferencing, login data, Social networking details (Geo locations, etc).
https://en.wikipedia.org/wiki/PRISM_%28surveillance_program%29

If you wish to exclude yourself and your data from this type of collection then a place to start is by making sure your personal email is encrypted in transit and at rest by using a secure email provider.

Proton mail is a provider that offers encrypted email with data stored on servers in Switzerland, a country known for its privacy laws.  Proton mail is unable to provide access to your data to any country or entity because 1.  Swiss laws do not allow it.  2.  Proton mail does not have cryptographic access to your data.
https://protonmail.com/privacy-policy

Read More

Topics: Cyber Security

In the Know - Cyber Security Update - Aftermath of Equifax

Posted by Eric Brown on Sep 12, 2017 10:24:51 AM

This week, instead of reporting five incidents of the previous week, I’m just going to focus on one, the Equifax breach. With over half of the adult population in the US impacted, it is likely that you, or someone you know is affected.
Over the next two weeks I’ll provide an overview of steps we can all take to tighten up our own security, starting with preventing unauthorized use of our personal information. Most of these solutions are free or low cost.
We’ll start with the most important items first and things that would ideally be done this week. If you are unable to, or are reading this at a future point in time, the items are still relevant and can be done anytime.
There are four credit bureaus, three that report credit and assign a score – Experion, Equifax, Transunion, and one, Innovus, that just reports on credit. We’re going to work with all of them to make sure that you have full control over your credit.

Read More

Topics: Cyber Security

In the Know - Cyber Security Update - Week of August 27th-September 3rd

Posted by Eric Brown on Sep 5, 2017 7:42:32 AM
St. Jude pacemakers get a patch, your Amazon wishlist could be exposed to anyone who knows your email address, security researchers deconstruct a gift card attack, yet another unsecured Amazon S3 bucket exposes millions of records, and Google reminds site administrators the next version of Chrome will warn visitors if a site isn’t protected with an SSL certificate.


1.  
465,000 St. Jude pacemakers to receive a critical patch - a year after a vulnerability was discovered 

A critical flaw in the code of St. Jude, now Abbot, pace makers manufactured before August 28th 2017 allows, would be, attackers the ability to gain access and control the device from up to 50 feet away.

The attacker could issue commands to change the way the device functions or cause it to stop functioning all together.

A year ago (8/26/16) security researchers partnered with an investment firm and published this information.   The investment firm drew ire for shorting the stock, but believed that publishing was the only way to get St. Jude to take action, and that the people who had these devices inside their bodies had a right to know.

Read More

Topics: Cyber Security

In the Know - Cyber Security Update - Week of August 20th-August 27th

Posted by Eric Brown on Aug 28, 2017 8:19:01 AM

Google removes 500 apps from the Play marketplace due to Trojan horse style spyware, iPhone 7/7Plus hacked, Facebook messenger spreads malware, another Amazon S3 bucket left open, this time exposing 1.8M Chicago voter records. And thousands of IoT device IP address and passwords exposed on Pastebin.

 

 

Read More

Topics: Cyber Security