Turn Cortana Off At Lock Screen To Avoid Potential Hack

Do you use Cortana?  It’s a handy virtual assistant (like Siri) built into Windows 10.  Unfortunately, as useful as she is, there’s a problem. Even if you don’t use Cortana yourself, take heed:  Microsoft has recently issued a security update based on findings by McAfee researchers.

It turns out that Cortana can be “summoned” from the lock screen of your PC and used to execute attacks by tricking the ever-helpful Cortana into indexing files from a USB drive, then executing them.

To accomplish the attack, the hacker would need physical access to the PC. Once they had that, they could easily execute Powershell scripts to reset your Windows 10 password, which would then give them unfettered access.

The vulnerability takes advantage of two things:  First, Cortana “listens” for commands, even while the PC is locked. Then, the OS indexes files constantly so that they’re ready to use at a moment’s notice.  Put those two elements together and you have the makings of a disaster.

Microsoft has rushed a patch out the door to address the issue. For now, the company is advising users to simply disable Cortana on the lock screen, so that your PC has to be unlocked in order for her to be active.  It’s probably good advice, given that not all companies update their OS as soon as patches are available, and this one is important.

To be safe, even if you don’t use Cortana, go into settings and disable the virtual assistant on the lock screen.  Then, when you’re away from your PC, at least that’s one less thing you have to worry about.

Unfortunately, this isn’t the first Cortana-related security issue we’ve seen, and it’s not likely to be the last.  As useful as the feature is, it does open the door to a number of other (potential) problems.  Stay vigilant.

T-Mobile And Sprint To Merge Companies

The on-again, off-again talks about a merger between T-Mobile and Sprint is definitely back on, with T-Mobile planning to buy Sprint for a staggering $26 billion.

The deal has been in the works since before Trump was elected President. It died quietly when it became clear that the Obama administration would not allow the deal to go forward, due to concerns that it would leave the US with only three telecom providers, which could harm consumers.

The Trump administration has made it clear that they applaud the move.  However, Trump’s Justice Department may be a significant hurdle to clear.  Nonetheless, as things stand now, the deal is steaming ahead and the combined company would have a whopping 127+ million customers, putting it not far behind AT&T’s 141.6 million and Verizon Wireless’ 150.5 million customers. T-Mobile’s CEO John Legere would lead the new, larger company.

John had this to say about the planned merger:

“This combination will create a fierce competitor with the network scale to deliver more for consumers and businesses in the form of lower prices, more innovation, and second-to-none network experience – and do it all so much faster than either company could on its own.”

The underlying argument in favor of the merger is that the US is falling behind in terms of network speed. If there is to be any hope of arriving first at a nationwide 5G network, we need bigger, stronger and more robust competitors.

As history shows us clearly though, the regulators of the previous administration have valid concerns about the monopolization of the industry.  Any time there are fewer competitors on the board, regardless of the industry, consumers invariably get hit with higher prices. There’s no reason to believe this merger will lead to a different outcome.

Regardless, it now appears that the merger is likely to happen.

Some VW and Audi Cars May Be Hacked Through WiFi

Thanks to researchers Daan Keuper and Thijs Alkemade (who work at the Dutch cyber-security firm Computest), newly produced Golf GTE and Audi A3 vehicles are a little bit safer, and a lot less vulnerable to remote hacks.

The duo found that by taking advantage of these vehicles’ WiFi connection, they could access the cars’ IVI, (in-vehicle infotainment system) and from there, gain access to other systems as well.

The researchers had this to say about their work:

“Under certain conditions, attackers could listen in to conversations the driver is conducting via a car kit, turn the microphone on and off, as well as gaining access to the complete address book and conversation history.  Furthermore, due to the vulnerability, there is the possibility of discovering through the navigation system precisely where the driver has been, and to follow the car live wherever it is at any given time.”

It gets worse though.  Once the researchers had gained access to these systems, they found they could also access the car’s braking and acceleration systems. They stopped short of performing exploits on these for fear of violating Volkswagen’s intellectual property rights.  A hacker, however, would not hesitate to do so.

Worse still, the company apparently had no idea there was a problem. In fact, when the researchers presented their findings, they discovered that the company had deployed the IVI system completely untested.

Since bringing the issue to the company’s attention, they have addressed the issue. However, the fix only applies to newly manufactured vehicles.  If you purchased either of the models listed above prior to June 2016, your vehicle has not received the fix, and will not get fixed unless you take it back to the dealership.  There’s no way for the company to remotely install it.  That means there are untold thousands of cars on the road right now that are vulnerable.

All Twitter Passwords Exposed, Change Your Password Now

Twitter shot itself in the foot recently but is working hard to get out in front of the problem.  According to a recent blog post, the company experienced an issue with its hashing routine – a process which masks user passwords, making them virtually impossible to crack.

Because of the issue, user passwords were stored as plain text on an internal log file.  The company found the bug on its own, conducted an investigation and found no evidence that anyone discovered the log file and appropriated it.  Although they gave no indication as to how many user passwords the log file contained, they nonetheless urged all of their 330+ million users to change their passwords immediately as a safety precaution.

This could have been far worse for the company, had the log been discovered by a diligent security researcher, or worse still, by a hacker.  Even so, it’s a fairly damaging bit of news that’s sure to cause at least some lost trust with its growing user base.

If you use Twitter, you should definitely take the company’s recommendation to heart and change your password immediately.  As ever, when you do, the best thing you can do to help yourself is to be sure you’re not using the same password on Twitter as you use on other websites you frequent.  That way, even if your password is compromised, the damage will be limited to your Twitter account only.

An even better solution would be to use a password safe, which securely stores the passwords of the various sites you frequent. Although even this step doesn’t provide bullet-proof protection, as password safes are by no means immune to hacking.

Diligence and vigilance are once again the keys.  Keep your passwords secure and change them often.

Vulnerability In Mac OS Went Unnoticed For Years

Researchers at Okta Security have stumbled across something big.  Recently, they discovered a flaw in Apple’s OS that would have allowed hackers to completely undermine Apple’s code signing process.

While at first glance that doesn’t sound so bad, the implications are terrifying.  In a nutshell, code signing uses cryptographic “signatures” to verify and validate code.  If code bears the digital signature, it is considered trusted.  If it’s trusted, then it’s given an automatic free pass, straight into the heart of any system.

Unfortunately, this flaw in Apple’s code signing process dates back more than a decade. It was only recently discovered, and purely by chance at that.

An extensive forensic analysis has turned up no evidence suggesting that this exploit was ever used for nefarious purposes, which is the one silver lining in all of this.

Upon discovering the flaw, Okta personnel reached out to Apple and other vendors who could have been impacted by the flaw, including tech giants like Google, Facebook and also smaller players like VirusTotal, Objective Development, Yelp, and Carbon Black.

Apple moved swiftly and has since fixed the issue, so this one can be considered a bullet dodged.

Josh Pitts, an Okta engineer, sums the issue up:

“Different types of tools and products use code signing to implement actionable security; this includes whitelisting, antivirus, incident response and threat hunting products.  To undermine a code signing implementation for a major OS would break a core security construct that many depend on for day to day security operations.”

A completely fair assessment.  Thankfully (at least in this particular case), although the issue was hiding in plain sight, it does not appear to have been exploited before being fixed.  We won’t always be so lucky.

Watch Out For Rise In Microsoft Office Attacks 

Menlo Security has recently published a new report that will probably dismay you if you’re a business owner.

Microsoft Office has been named as the attack vector of choice for hackers around the world. The most common form of the attack is a malicious Word document or other office document attached to an innocent looking email.

There are, of course, plenty of other ways to take advantage of various security weaknesses in MS Office and Office 365.  These include the use of remotely hosted malicious components embedded within documents that deliver zero-day exploits when the document is opened.

The reason MS Office is such a wildly popular choice isn’t because it has an unusual number of security loopholes that can be exploited (although it’s certainly got its share).  Rather, it has everything to do with the overwhelming popularity of the office suite.  Simply put, lots of people use it on a regular basis, and that means the pool of potential victims is enormous.

As the report explains:

“There is likely to be an increase in attacks via malevolent email attachments using stealthily embedded, remotely hosted malicious components that leverage applications and operating system vulnerabilities, both old and new.

With CVE-2018-8174 and CVE-2018-5002, the attackers leveraged Word as a vector to exploit Adobe Flash Player and Internet Explorer.  By using Word as the vector, the attackers were able to exploit a browser, even if it is not the default browser, and exploit Flash, even though Flash is blocked by most enterprises…Microsoft is therefore undoubtedly going to become the platform that attackers leverage most to deliver their zero-day exploits.”

All true, and beyond troubling.  If your business uses Microsoft Office or Office 365 (and odds are excellent that it does), continued vigilance is the key.

Facebook Is Adding New Features, Including Dating 

At this year’s F8 Developer’s conference, Facebook announced a raft of changes and updates it will be rolling out later this year.  Some are fun, others practical, but they’re all interesting.  Here are the highlights:

Get Ready for “FaceDate”

This announcement is interesting. Not so much because the idea of using Facebook to meet someone is new, but because of what the announcement did to the stock prices of existing companies.

The new feature will look and feel a bit like Tinder, with a few important caveats:

  • Your FaceDate profile will be separate from your Facebook profile
  • The app will not match you with your existing Facebook friends
  • Your existing friends will not see, or even know about your FaceDate profile (unless you tell them, of course)

Facebook fanatics will no doubt love this feature, but the news caused the stock prices of two online dating companies to fall sharply. These included Match Group (parent company of Match.com) tumbling 22 percent, and IAC (parent company of both Tinder and Match Group) falling 16 percent.

Third Party App Review Starting Up Again

In the wake of the Cambridge Analytica scandal, the company suspended its third-party app review.  That is re-opening starting Tuesday, so by the time you read these words, app review should once again be in full swing.  The major change here is that the company will now require business verification for apps that need access to specialized API’s or extended login permissions.  Apps asking for basic profile information only will not be subject to this new requirement.

Real Time Language Translations In Messenger

A long-anticipated feature addition, the company is taking a cautious approach here.  When the feature is initially rolled out, it will only translate English-Spanish conversations, with additional languages added incrementally.  In addition to the translation feature, the messenger interface will also get some tweaks and improvements.

“Clear History” Feature Being Added

This one is aimed specifically at the lingering privacy concerns Facebook’s CEO was recently grilled about when he appeared before Congress.  In a bid to increase user privacy, Facebook will now allow its users to see the apps and websites that send Facebook information when in use, and allow users to turn off Facebook’s ability to store that data.  It’s a good first step, but it remains to be seen how helpful it will be in terms of increasing user privacy.  There’s no good way to know that until we get the opportunity to see the new feature in action.

All in all though, a productive conference, with a number of interesting changes ahead.

New SSD Drive Can Hold 8TB of Storage

Good news for the business world in general, and the owners of data centers, in particular.

Mass storage is about to get vastly more efficient thanks to Samsung’s recently launched solid state drive, which manages to pack an impressive 8TB of storage into a delightfully small footprint, measuring just 11cm x 3.05cm.

Not only do the new drives deliver twice the storage capacity of the SSDs used in high-end servers and slim line laptops, but it also has an impressive read speed of 3100 MB/s, and write speeds of 2000 MB/s. The read speed of the new drive is five times faster than the speeds you typically get from SATA SSDs, and the write speeds are three times faster.

When hyper-scaled, that means that enterprise server system could perform more than a million IOPS in a 2U rack space, and that translates into a significant ROI for large-scale data centers.

It gets even better. Samsung is planning to release a 512 gigabit version of its 3-bit V-NAND SSD later this year, which will allow significant improvements in processing speeds for big data applications.

What we’re talking about here, ultimately, is storage and processing density. The new SSD is built with 16 512GB NAND package, stacked in sixteen layers of 256 gigabit 3-bit V-NAND chips that were specifically engineered with massive SSDs in mind.

This allows data centers to triple total system density in the same footprint, and allows for a mind-boggling 576 terabytes of storage in 2U rack servers.

This is paradigm shifting and will make cloud-based service providers even more attractive. The most successful of these already have hyper-scale data centers in place, already have a wealth of experience when it comes to handling Very Large Data sets and experience dealing with applications designed to sift through those mountains of data. Enterprise users, rejoice!