Tag: Technology News

T-Mobile And Sprint To Merge Companies

The on-again, off-again talks about a merger between T-Mobile and Sprint is definitely back on, with T-Mobile planning to buy Sprint for a staggering $26 billion.

The deal has been in the works since before Trump was elected President. It died quietly when it became clear that the Obama administration would not allow the deal to go forward, due to concerns that it would leave the US with only three telecom providers, which could harm consumers.

The Trump administration has made it clear that they applaud the move.  However, Trump’s Justice Department may be a significant hurdle to clear.  Nonetheless, as things stand now, the deal is steaming ahead and the combined company would have a whopping 127+ million customers, putting it not far behind AT&T’s 141.6 million and Verizon Wireless’ 150.5 million customers. T-Mobile’s CEO John Legere would lead the new, larger company.

John had this to say about the planned merger:

“This combination will create a fierce competitor with the network scale to deliver more for consumers and businesses in the form of lower prices, more innovation, and second-to-none network experience – and do it all so much faster than either company could on its own.”

The underlying argument in favor of the merger is that the US is falling behind in terms of network speed. If there is to be any hope of arriving first at a nationwide 5G network, we need bigger, stronger and more robust competitors.

As history shows us clearly though, the regulators of the previous administration have valid concerns about the monopolization of the industry.  Any time there are fewer competitors on the board, regardless of the industry, consumers invariably get hit with higher prices. There’s no reason to believe this merger will lead to a different outcome.

Regardless, it now appears that the merger is likely to happen.

Some VW and Audi Cars May Be Hacked Through WiFi

Thanks to researchers Daan Keuper and Thijs Alkemade (who work at the Dutch cyber-security firm Computest), newly produced Golf GTE and Audi A3 vehicles are a little bit safer, and a lot less vulnerable to remote hacks.

The duo found that by taking advantage of these vehicles’ WiFi connection, they could access the cars’ IVI, (in-vehicle infotainment system) and from there, gain access to other systems as well.

The researchers had this to say about their work:

“Under certain conditions, attackers could listen in to conversations the driver is conducting via a car kit, turn the microphone on and off, as well as gaining access to the complete address book and conversation history.  Furthermore, due to the vulnerability, there is the possibility of discovering through the navigation system precisely where the driver has been, and to follow the car live wherever it is at any given time.”

It gets worse though.  Once the researchers had gained access to these systems, they found they could also access the car’s braking and acceleration systems. They stopped short of performing exploits on these for fear of violating Volkswagen’s intellectual property rights.  A hacker, however, would not hesitate to do so.

Worse still, the company apparently had no idea there was a problem. In fact, when the researchers presented their findings, they discovered that the company had deployed the IVI system completely untested.

Since bringing the issue to the company’s attention, they have addressed the issue. However, the fix only applies to newly manufactured vehicles.  If you purchased either of the models listed above prior to June 2016, your vehicle has not received the fix, and will not get fixed unless you take it back to the dealership.  There’s no way for the company to remotely install it.  That means there are untold thousands of cars on the road right now that are vulnerable.

All Twitter Passwords Exposed, Change Your Password Now

Twitter shot itself in the foot recently but is working hard to get out in front of the problem.  According to a recent blog post, the company experienced an issue with its hashing routine – a process which masks user passwords, making them virtually impossible to crack.

Because of the issue, user passwords were stored as plain text on an internal log file.  The company found the bug on its own, conducted an investigation and found no evidence that anyone discovered the log file and appropriated it.  Although they gave no indication as to how many user passwords the log file contained, they nonetheless urged all of their 330+ million users to change their passwords immediately as a safety precaution.

This could have been far worse for the company, had the log been discovered by a diligent security researcher, or worse still, by a hacker.  Even so, it’s a fairly damaging bit of news that’s sure to cause at least some lost trust with its growing user base.

If you use Twitter, you should definitely take the company’s recommendation to heart and change your password immediately.  As ever, when you do, the best thing you can do to help yourself is to be sure you’re not using the same password on Twitter as you use on other websites you frequent.  That way, even if your password is compromised, the damage will be limited to your Twitter account only.

An even better solution would be to use a password safe, which securely stores the passwords of the various sites you frequent. Although even this step doesn’t provide bullet-proof protection, as password safes are by no means immune to hacking.

Diligence and vigilance are once again the keys.  Keep your passwords secure and change them often.

Vulnerability In Mac OS Went Unnoticed For Years

Researchers at Okta Security have stumbled across something big.  Recently, they discovered a flaw in Apple’s OS that would have allowed hackers to completely undermine Apple’s code signing process.

While at first glance that doesn’t sound so bad, the implications are terrifying.  In a nutshell, code signing uses cryptographic “signatures” to verify and validate code.  If code bears the digital signature, it is considered trusted.  If it’s trusted, then it’s given an automatic free pass, straight into the heart of any system.

Unfortunately, this flaw in Apple’s code signing process dates back more than a decade. It was only recently discovered, and purely by chance at that.

An extensive forensic analysis has turned up no evidence suggesting that this exploit was ever used for nefarious purposes, which is the one silver lining in all of this.

Upon discovering the flaw, Okta personnel reached out to Apple and other vendors who could have been impacted by the flaw, including tech giants like Google, Facebook and also smaller players like VirusTotal, Objective Development, Yelp, and Carbon Black.

Apple moved swiftly and has since fixed the issue, so this one can be considered a bullet dodged.

Josh Pitts, an Okta engineer, sums the issue up:

“Different types of tools and products use code signing to implement actionable security; this includes whitelisting, antivirus, incident response and threat hunting products.  To undermine a code signing implementation for a major OS would break a core security construct that many depend on for day to day security operations.”

A completely fair assessment.  Thankfully (at least in this particular case), although the issue was hiding in plain sight, it does not appear to have been exploited before being fixed.  We won’t always be so lucky.

Healthcare Sector Facing Rise In Ransomware Attacks

The Department of Health and Human services has issued a warning to healthcare providers to be on high alert for the SamSam strain of ransomware, which has been used to attack eight different health care entities so far this year.

SamSam made its first appearance in 2016 and is seeing increasingly widespread use so far this year.  Unfortunately, the healthcare industry is considered by most to be a soft target. On the Dark Web, healthcare data has become more highly sought after than credit card data, which is only going to put more healthcare entities at risk.

The most tragic component of this is that when a hospital’s network goes down, they stand to lose more than just money and control over patient data.  Lives are also at risk.  Although none of the attacks to this point have resulted in patient deaths, it’s statistically inevitable.  As these attacks continue to increase in frequency, scope and scale, sooner or later, someone will die because of them.

According to security experts, the root of the problem lies in the fact that guarding against such attacks is seen as fundamentally an IT issue.  The truth is that it is an organization-wide issue, and should be treated as such, because attacks like these pose an existential threat.  Treating the issue as something for a single department to be responsible for inevitably leads to a lack of funding and an inadequate incident response plan. This leaves most organizations completely unprepared to deal with an attack and its aftermath.

Even more worrisome is the fact that an increasing number of ransomware attacks simply destroy the data.  Sure, the ransom note still gets displayed, but the hackers simply have no intentions of unlocking the files, and they build their software accordingly. Most recently, hackers have taken to corrupting encrypted data files, which can cause lingering problems for months or even years after they’re unlocked.

This problem is only going to get worse until we all start taking data security more seriously.