InfoSec
Is the Internet built for spying?
The one and only internet <img src="https://ekiledjian2.micro.blog/uploads/2025/b57c63d44e.jpg" alt=""> Edward Snowden is the (now famous) NSA leaker that exposed many of the US intelligence community's most secretive tools to the world. As expected, the public reacted (some would say over-reacted). There is one internet I believe the Internet will be recorded in history as one of the great evolutionary drivers. With the global availability of human knowledge and the ability to create brand new beneficial services (like the Scanadu home health monitor).
Move your email service to Switzerland
Since the PRISM revelations, we have seen a handful of "secure" email services shutter their doors or close their email services (Silent Circle, Lavabit, etc). Then came the shutdown of websites dependent on anonymity of sources (Groklaw). With all the turmoil, you may be looking for an email service less likely to bend to the will of the NSA (or other national security agency). I can't think of a better country than Switzerland. The email service recommended by the founder of Groklaw is now offering a less expensive lite of its email service.
TrueCaller database stollen (millions of telephone numbers)
Another day brings news of another popular web service getting hacked and having its data stollen. The victim this time is a popular mobile app called TrueCaller. The Syrian Electronic Army claims to have breached TrueCaller's security by exploiting a WordPress flaw and stealing 7 databases. Sorry @Truecaller, we needed your database, thank you for it :) http://t.co/fC6ZyYAGTG #SEA #SyrianElectronicArmy — SyrianElectronicArmy (@Official_SEA12) July 17, 2013 The Syrian Electronic Army claims to have gained access to 1 million social networking accounts (Facebook, LinkedIn, Twitter and Google) through this exploit.
What info does Rogers shares with the Government
With all of the hoopla around Prism in the US, many Canadians may be wondering what Rogers' policy is about sharing customer data with the government. Here is their position: @ekiledjian we'd only share information about a customer if a warrant has been issued 2/2 — Nicolas @ Rogers (@RogersNicolas) July 9, 2013 I've reached out to Telus, Bell and Fido & am waiting for their responses
Washington Post claims Chinese access defense information
The Washington Post claims to ahev gained access to classified documents stating that Chinese hackers compromised systems contrianing information about the USA's highly classified cutting edge defense products (like the F-35 and PAC3 PAtriot missiles). The report goes on to list other critical defense systems like the Aegis ballistic-missile defense system, F/18, V22, etc. Could this report be the reason the US Government has started to take a much stronger and much more public stance against Chinese hackers?
Chromium browser can clean-up after malware infections
Even the most careful internet user may find himself/herself on a questionable site that loads the browser with all kinds of "wonderful gifts" like toolbars, new search engines, extensions and the like. Normally recovering from something like this is painful and time consuming. A crafty and detail oriented individual, Francois Beaufort, discovered a new feature in Chromium called reset profile which resets everything back to factory defaults: homepage search engine cookies and disables the extensions Why is this interesting?
Enable 2-factor authentication for Google services
Related Article: How To Secure Your Online Accounts How to enable 2-factor authentication for Google Sign into your Google account Click the arrow next to your name Choose Account Select Security Click settings listed under 2-step verification You have to start the setup process. You are then asked to supply a telephone number where an authentication code will be sent when you login from an “untrusted computer or device”. A code then arrived that you have to enter when Google login detects something strange.
How to secure your online accounts
What is 2-factor authentication? One of the most common ways to hijack your online accounts is to steal your passwords. The way to prevent this type of issue is to use a technique called 2-factor authentication. The 2 factors are: Something you know : your password which is still used Something you have : a one-time use password that is generated on demand that proves you are in possession of something physical. You use 2-factor authentication everytime you use your bank’s automated banking machine.
Saudi Aramco Twitter account hacked
Due to recent attacks again Twitter and high profile Twitter users, Twitter has started implementing new security measured. Now we learn that the official account of Saudi Aramco (the world’s largest oil producer) was hacked by “Mister Rero”. Saudi Aramco is no stranger to infosec issues and had 30,000 workstations hacked last year. Don’t forget other twitter accounts were also recently hacked from Burger King, Jeep, etc.
Evernote will implement 2 factor authentication
A couple of days ago, I wrote about Evernote being hacked and the fact that it is the new reality for cloud services. Now we learn that Evernote intends to implement 2 factor authentication. In case you were not aware, Evernote was hacked and it forced its 50 million users to reset their passwords. According to InformationWeek, they will offer some kind of 2 factor authentication for all of their users before the end of the year.
250,000 twitter accounts hacked
It has been a bad week for popular websites (getting hacked). Now Twitter has come forward and acknowledged that 250,000 accounts were hacked. The attacker may have had access to email addresses, encryption passwords and session tockens. What is worrisome is that Twitter has claimed that the attack was "extremely sophisticated" and that they saw this same pattern of attach against other sites. Twitter is being proactive and is forcing users of those affected accounts to immediately change their passwords (those affected should have received an email from the company).
Whatsapp breaking Canadian privacy laws
It seems everyone’s favorite cross-platform Instant Messaging app has is violating Canadian privacy laws (according to the Office of the Privacy Commissioner of Canada). The OPC found that on all devices (except IOS 6), the App requires access to the users address book to function. This means that non WhatsApp user information is being stored on the WhatsApp servers without the permission of these users. WhatsApp is “trying to meet” Canadian regulations by adding encryption and other protections but the OPC believes they are not yet compliant with Canadian law and will continue monitoring the firms progress.
How to properly lock down your Facebook privacy settings
Facebook has gone to great length to make sure everyone know that Graph Search won’t reveal anything that isn’t already visible to the person conducting the search. However people may be able to find information about you because of privacy setting misconfigurations you may have made. It is a great time to make sure you have properly locked down your Facebook privacy settings. Click on the little gear icon (upper right hand side) and choose “Privacy Settings”. First Then
Employees leaking information to competitors
As an infosec leader working for a large multinational, a lot of risks keep me up at night. Most execs still believe (mistakenly) that the biggest risks come from the outside. Imagine my interest when I learned that AMD is suing 6 former employees because it believes they leaked over 100,000 documents ("trade secret materials relating to developing technology") to NVIDIA. The complaint says these employees took the info with them when they switched employers. AMD claims to have uncovered evidence of their claim using “forensically revealed data”.
Silent Circle enables secure VOIP calling from Android
I wrote about Silent Circle in October and was excited to learn that they recently released an Android app and enabled Out of Circle calling. Silent Circle will enable secure voice, text, email and video chatting from any Silent Circle client to another (Android -> Android or Android -> iPhone).
The app can be downloaded from the Google Play Store. Using their service is simple and straightforward. You download the app, create an account and then pay the $20 monthly service fee. As soon as this is done, you will be able to call Silent Circle to Silent Circle securely regardless of where in the world you are (over WIFI, 3G or 4G).
They also added an "Out-Circle Access" which will enable Silent Circle users to call regular phone lines. You link is encrypted from the device until the Silent Circle boundary (which is a nice feature for people working in some questionable countries). This feature costs an additional $29 a month but includes unlimited calling to Canada, US and Puerto Rico.
Here is the full Press Release
Silent Circle Releases Silent Phone For Android And Out-Circle Access (via PR Newswire)
Private encryption service developed by PGP inventor Phil Zimmermann protects voice and video calls on both Android and iOS devices across cellular and Wi-Fi networks Download image WASHINGTON, Jan. 16, 2013 /PRNewswire/ -- Silent Circle, a global private encrypted communications firm revolutionizing…
WolframAlpha can generate strong passwords
With all the hacking reports we saw in 2012, I hope all of you understand how important it is to generate a strong and unique password for each of the online services you use. You can create a strong password yourself or you can use one of my favorite websites, WolframAplha, to create one for you. Go to Wolfram Alpha In the query box, enter Generate Password Click on the first option and press enter It then generates an 8 character strong password
Your cloud service is shutting down. Now what?
2012 was an interesting year where more services were moved to the cloud and at the same time we saw the risk of cloud services shutting down. In the case of MegaUpload.com (the notorious filesharing site shutdown by the FBI), the government seized all of the hosting servers and made all the information on them unreachable. Even legitimate users ,like the XDA developers, end up losing their information (over 200,000 XDA files were hosted on MegaUpload – all legal). Other times, a commercial decision is made that can see a free service become for pay or a service can be shelved completely.
Korea is targeting Russia via espionage campaign called Sanny
Anytime I talk about cyber-espionage, the first reaction most people have is that China must be behind the effort. The reality is that most countries have cyber-espionage capabilities and they use it to further their own interests. My eyes widened and my ear perked up when I read a research paper by FireEye about a possible cyber-espionage campaign against Russian industry by Korea. I say Korea because FireEye hasn’t clarified whether the source is North or South Korea. It seems most companies being targeted as in space research, IT, education and telecommunication.
Scammer want your password. Here's how to protect it
As a business leader working in the information security field, I usually add extra doses of "question everything", "trust no one" and "double check everything" into my life. As the holiday season approaches, everyone seem happier, more cheerful and sometimes more trusting. Scammers are out in force trying to steal your information and identity so this post is a little reminder to be extra vigilant this holiday season. One tip is to never ever ever ever ever share your password with anyone.
An easy way to encrypt your emails and keep its contents safe
I had written an article a while back entitled "Is Microsoft Going Through Your Cloud Stored Files?". Whether the analysis of your content is done by a human, a robot or disgruntled employee, it feels wrong and there are times when you absolutely need to make sure the info in a particular email is secure & protected. You can always install one of the open source PGP alternatives but require complicated setup and key exchange (which makes these non usable by the average Joe).