Tag Archive for Security

| January 6, 2015
Comments Off on UMich Helps Secure the Web with Let’s Encrypt

UMich Helps Secure the Web with Let’s Encrypt

UMich Helps Secure the Web with Let’s EncryptThe University of Michigan is teaming up with leading Internet firms to help secure the web. UMich, Cisco (CSCO), Akamai (AKAM), Mozilla, the Electronic Frontier Foundation, and public key certificate authority IdenTrust, have launched a new free certificate authority (CA) called Let’s Encrypt.

The Let’s Encrypt CA, which will be available in the Summer of 2015. It aims to get people to encrypt their connections to their websites according to a recent GigaOM article. Let’s Encrypt goal is to make it easier to get a proper Secure Sockets Layer/Transfer Layer Security (SSL/TLS) certificate. That way the certs can be deployed to secure a Web server and its users.

Let’s Encrypt will help secure the Internet

Let’s EncryptAccording to the article Let’s Encrypt, comes as the tech industry scrambles to encrypt the web. This is more important after the mass surveillance revelations of NSA leaker Edward Snowden. The CA will aid other efforts to secure the Internet.

Let’s Encrypt is developing the Automated Certificate Management Environment or ACME protocol. The ACME protocol. will sit between Web servers and the CA. It includes support for new, stronger forms of domain validation.

University of MichiganLet’s Encrypt will serve as its own root CA. The nonprofit CA public benefit corporation, Internet Security Research Group (ISRG) will run the root CA. Josh Aas, the executive director of ISRG, explained securing the web is just not a simple thing to use Transport Layer Security (TLS), the successor to Secure Socket Layer (SSL). He explains that getting, paying for, and installing a certificate is too hard for many network administrators.

The anchor for any TLS-protected communication is a public-key certificate which demonstrates that the server you’re actually talking to is the server you intended to talk to. For many server operators, getting even a basic server certificate is just too much of a hassle. The application process can be confusing. It usually costs money. It’s tricky to install correctly. It’s a pain to update.

Electronic Frontier FoundationAccording to the statement, Let’s Encrypt’s certificates will be free. It will have an automated issuance and renewal protocol – an open standard. A step to reduce the need for input from the domain holder’s side. According to an EFF blog post, “switching a webserver from HTTP to HTTPS with this CA will be as easy as issuing one command, or clicking one button.”

Records of certificate issuance and revocation will be publicly available. The organizations behind Let’s Encrypt are stressing that the system won’t be under any one organization’s control.

The EFF has been working on helping users take advantage of HTTPS for a while. The EFF worked with the Tor Project, to create the HTTPS Everywhere extension for Firefox, Firefox for Android, Chrome, and Opera browsers.

The Let’s Encrypt project will use Internet-wide datasets of certificates to make higher-security decisions about when a certificate is safe to issue. The data will include the EFF’s Decentralized SSL Observatory, the University of Michigan’s scans.io, and Google‘s (GOOG) Certificate Transparency logs.

In addition to the Let’s Encrypt project, some of the paths to secure the web include:

  • The next version of the HTTP protocol will likely be encrypted by default.
  • Mozilla and Firefox are collaborating with the EFF to bring Microsoft, Google, Opera, and others to add Let’s Encrypt to their list of valid CAs.
  • Google will rank up sites that use SSL/TLS encryption.
  • The content delivery and security outfit Cloudflare is offering free SSL encryption for millions of its customers.
  • And now Let’s Encrypt aims to equip websites with free certificates – the proof they need to tell users’ browsers that their public encryption keys are genuine and the connection is properly secured.

rb-

Many websites currently use the HTTP protocol, a standard that exposes site owners to a number of threats including cyber espionage, keyword-based censorship, account hijacking, and a host of web application attacks such as SQLi and XSS. Let’s Encrypt helps reduce these risks which I think it is a good step in the right direction.

argues on Wired that Let’s Encrypt does not go far enough. We want the project to not only encrypt data but also authenticate users. IMHO that is a pipe dream. Authentication will step on the toes of Symantec, Oracle, and other hugely funded firms that will squash anybody doing the right thing that threatens their profits.

Related Posts

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: , , , , , , , , , , , , ,
| December 4, 2014
Comments Off on Privacy for Drivers

Privacy for Drivers

Privacy for DriversFord Motor Company (F) Global Marketing Director Jim Farley touched off a privacy storm when he told an audience at the Consumer Electronics Show that the automaker is tracking their travels thanks to their in-car navigation systems. He told the crowd in Las Vegas that the automaker tracks driver behavior, “We know everyone who breaks the law, we know when you’re doing it.”

automaker are tracking travelsThe auto manufacturers have installed “black boxes” on most modern cars. The black boxes are capable of tracking, gathering, and storing vehicle information. In fact, the Fed has proposed that such tracking technology become standard equipment on all cars.

Privacy firestorm

Even though Ford quickly backed down from Mr. Farley’s claims, the comments created a privacy firestorm. As a result, TheDetroitBureau.com reports that privacy advocates accelerated increased pressure on manufacturers to reveal what info that collects on “black box’s” they’re doing with the personal data they do collect – and put limits on how it can be used.

black-boxes are capable of tracking, gathering and storing vehicle information.

In response, a group of 19 automakers has gotten together to lay down some ground rules, which they hope will assuage fears about the accessibility and use of the material. According to the article, the makers say the information won’t be given to government officials or law enforcement agencies without a court order, sold to insurance companies or other companies without their permission.

The automakers agreeing to the “rules,” which they submitted to the Federal Trade Commission, include Aston Martin, BMW, Chrysler (STLA),  Ferrari, Ford, General Motors (GM), Honda (HMC) Hyundai, Kia, Maserati, Mazda, Mercedes-Benz, Mitsubishi, Nissan, Porsche, Subaru, Toyota, Volkswagen, and Volvo.

Self-imposed data collection “rules”

Future carThe author speculates that the automakers are willing to abide by the self-imposed “rules” because they believe actual laws could become onerous. Sen. Edward Markey, D-MA is skeptical of the impact of the “rules.” He called them “an important first step,” but said it remains unclear “how auto companies will make their data collection practices transparent beyond including the information in vehicle manuals.”

Senator Markey noted that the automakers did not offer consumers an opt-out option for whether sensitive information is collected in the first place. He plans to legislate an answer. He said in a statement, “I will call for clear rules — not voluntary commitments — to ensure the privacy and safety of American drivers is protected,” Markey said in a statement.

The automakers also committed to “implement reasonable measures” to protect personal information from unauthorized access. Privacy experts are concerned that in recent years many vehicles have had a variety of GPS and mobile communications technology built into them.

Cloud securityThe TheDetroitBureau explains these devices record and sends all types of information which privacy advocates are afraid the data could be used by the government against the owners of vehicles. Some worry that many three-letter agencies and law enforcement will use data from the device to track citizens. Marc Rotenberg, executive director of the Electronic Privacy Information Center said that legislation is needed to ensure automakers don’t back off their self-imposed “rules” when they become inconvenient. He said,

You just don’t want your car spying on you. That’s the practical consequence of a lot of the new technologies that are being built into cars.

Pop-up ads on in-car touch screens

The black boxes now installed in new vehicles could also be a safety issue for drivers. The article speculates that the rising level of interactivity of cars could open the door for pop-up ads in cars. These automakers’ “rules” do not end the possibility that Pop-up ads could appear on the touch screens of cars, trucks, and SUVs as folks are motoring down the road.

One loophole in the guidelines identified in the blog, if customers agree at the time they buy the car, they could receive messages from advertisers who want to target motorists based on their location and other personal data according to the author. Some safety advocates are concerned about pop-up ads possibly popping up on in-car touch screens while drivers are behind the wheel. Henry Jasny of Advocates for Highway and Auto Safety warned the Associated Press.

There is going to be a huge amount of metadata that companies would like to mine to send advertisements to you in your vehicle … We don’t want pop-up ads to become a distraction.

rb-

Who is listeningThe road to hell is paved with good intentions and full of pot-holes. I covered Cisco’s try at monetizing driver data here. Industry officials say they want to assure their customers that the information that their cars stream from the vehicle’s computers to automakers (or Feds) via OnStar. Sync, Automatic, In-Drive, or Car-Net won’t be handed over to authorities without a court order, sold to insurance companies, or used to bombard them with ads for pizza, gas stations, or other businesses they drive past, without their permission.

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Cars | Tags: , , , , , , , , , , , , , , , ,
| November 25, 2014
Comments Off on Encryption on the Internet Primer

Encryption on the Internet Primer

Encryption on the Internet PrimerI spoke to several of my mother’s friends the other day. They were all worried about being on the web. Kudos to these ladies for being connected at all (they are in their 70’s and 80’s), They also get a gold star for being alert enough to recognize that something on the ol’ Intertubes has changed recently.

Data theftThey hear that their information is being stolen at the banks and stores they frequent. One neighbor lady even said she was worried but the government stealing her data. I explained to the group that I too am concerned about how it seems everyone on the web is under attack lately.

I gave them the usual pointers. Don’t trust anything on the web.  Have someone (not me!) help keep their anti-malware and systems up to date. And use encryption if possible.

Navajo Code Talkers

Of course, none of my mother’s neighbors had heard of encryption. I explained to the ladies that encryption means changing a message so that anybody who heard the message would not understand it unless they knew how the message was changed. I used the example of Ig-pay Atin-lay.

  • An-cay ou-yay eak-spay Ig-pay Atin-lay? = Can you speak Pig Latin?
  • I-way ave-hay a-way ecret-say = I have a secret.

 

Then of course I was outsmarted. One of the wNavajo Code Talkers during World War IIomen chimed out, Oh like the Navajo Code Talkers during World War II. (Next time I will start with the smart answer and then go to the Pig-Latin.)  These ladies lived through the shhesh,

So that got me thinking, what does the end-user really need to know about encryption? Sure there are PKI’s, Salted hashes, Block-ciphers, and …. none of which mean anything to the end-user.

What users need to know about encryption

Miguel Leiva-Gomez at MakeTechEasier.com recently explained what beginners need to know about encryption. He says that encryption is a practice in cryptography where a piece of data is obfuscated (manipulated) in a mathematically predictable way. The manipulation makes it very difficult to recover its contents. The author says it is like my pig-Latin example, but much more complex. The mathematical equations used to encrypt (and decrypt/decode) things are called cryptographic algorithms.

These cryptographic algorithms are needed because hackers are getting smarter and sneakier. They’re compromising databases left and right. To protect your data from attacks system owners should use these algorithms to mathematically jumble up all your personal data Jumbling the data (encrypting) making it difficult (if not completely impossible) for a hacker to steal your data from that database. Mr. Gomez claims that encryption basically protects you from intrusion. If a hacker manages to break into a database and take your passwords, it would be reading something like “EAFC49BF4B496090EA2B7CA51674589” instead of “Mary_$mith.”

The article calls the jumbled-up text like “EAFC49BF4B496090EA2B7CA51674589” at the end of every algorithm is called a ciphertext. The decrypted equivalent is known as plaintext. These are very important words to remember when discussing cryptography.

The author explains that there are two ways that the plaintext “Mary_$mith” gets turned into the ciphertext to “EAFC49BF4B496090EA2B7CA51674589” and then back to plaintext “Mary_$mith.” The first method is called a symmetric algorithm:

Symmetric algorithms use a key to Symmetric algorithm:encrypt and decrypt data. The key is basically the “x” that will solve for “y” in the mathematical algorithm. The length of the key and some other properties of the algorithm determine its “difficulty.” The more difficult an algorithm is, the more difficult it is to crack it. A difficult algorithm requires immense amounts of computing power to crack. The kind of horsepower that is usually out of reach from run-of-the-mill hackers. More sophisticated attacks might use computer clusters to decipher your data. Even then, some symmetric algorithms might thwart these attacks.

Asymmetric (public key) algorithms.The second-way plaintext gets turned into the ciphertext and then back to plaintext are called Asymmetric (public key) algorithms. Asymmetric algorithms split the key into two pieces. The first is a public one (usually stored in the server). The second piece is a private one (usually stored in your computer by software). Mr. Gomez writes that asymmetric algorithms get their strength from this particular technique since a hacker will not be able to read the contents of your data even if he gets his hands on the public key (it’s only half the key).

rb-

In the end, no algorithm is created equally. All of them have some flaw or another that will be discovered in the future, so it’s difficult to know what services you should rely on.

The best advice is still the oldest advice. Look for URLs that start with HTTPS and have a little green lock in the URL line. This means some part of the connection is encrypted with Secure Socket Layer (SSL) an Asymmetric (public key) algorithm. The Internet is on the verge of a move to a more secure Asymmetric algorithm called Transport Layer Security (TLS) 

That’s why the age-old advice to keep your PC up to date is critical for keeping your personal data safe.

Related articles
  • Navajo, Pawnee Code Talkers remembered on Veterans Day (KOB.com)

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: , , , , , , , , , , ,
| November 4, 2014
Comments Off on What is Ransomware?

What is Ransomware?

What is Ransomware?Ransomware is a nasty form of malware. It is also known as data kidnapping. It locks up your computer by encrypting your data and then demanding you pay a fee to unlock them. The fee is usually in Bitcoins. The decryption key may or may not unlock your files. Ransomware can be terrifying. We rely so completely these days on our PCs that to stare helplessly at yours—often with a racy image on the screen—is frustrating and crippling to your productivity. Cybercriminals may use one of several tactics to extort money from their victims.

Tactics to extort money

1. After a victim discovers he cannot open a file, he receives an email ransom note demanding a relatively small amount of money in exchange for a private key. The attacker warns that if the ransom is not paid by a certain date, the private key will be destroyed and the data will be lost forever.

2. The victim is duped into believing he is the subject of a police inquiry. After being informed that unlicensed software or illegal web content has been found on his computer, the victim is given instructions for how to pay an electronic fine.

Avoid sketchy websites3. The attackers sneak malware onto a computer, usually by a drive-by download, which encrypts the victim’s data but does nothing else. In this approach, the data kidnapper anticipates that the victim will look on the Internet for how to fix the problem and makes money by selling anti-ransomware software on legitimate websites.

Cut your ransomware risks

Here are tips that cut your risk of becoming a victim.

1. Avoid sketchy websites, searches, and downloads. You know the old expression “You can’t cheat an honest man”? Well, many (though not all) ransomware infections begin when a user surfs to pornographic or gambling websites, while others start with a click on a suspicious link. Steer clear of sites known to house malware, and never click a link in an email unless you know it is legit.

2. Back up your data. Experts stress that the single biggest thing that will defeat ransomware is having a regularly updated backup. That way, if you are beset by ransomware, you can restore your system while losing relatively little work.

3. Update your software regularly. Ransomware, like most malware threats, may sneak onto your PC through a known flaw in your operating system or other software programs. And hackers often rely on people running outdated software with those known vulnerabilities. You can definitely decrease the potential for ransomware if you make a practice of updating your software often.

4. Use a reputable security suite. It is always a good idea to have both anti-malware software and a firewall to help you identify threats or suspicious behavior. Malware authors often send out new variants, to try to avoid detection, which is why it’s important to have both layers of protection.

Anti-malware vendor Webroot provided this infographic that shows the prevalence of ransomware and the methods IT professionals use to deal with it.

Webroot Ransomwear infographic

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: , , , , , ,
| October 28, 2014
Comments Off on Risky Celebrities

Risky Celebrities

Risky CelebritiesComputer security firm McAfee says talk show host Jimmy Kimmel is the most dangerous celebrity to search for online. The company says that a search for ABC’s Kimmel carries nearly a 1 in 5 chance of landing on a website that has tested positive for spyware, viruses, or malware. Cybercriminals can use celebrities as bait to install malicious software and steal passwords or other personal data.

Risky celebrities

RankCelebrityRisk %
1
Jimmy Kimmel 19.38%
2 Armin van Buuren19.33%
3 Ciara
19.31%
4 Flo Rida
18.89%
5 Bruce Springsteen
18.82%
6 Blake Shelton18.47%
7
Britney Spears 18.19%
8Jon Bon Jovi
17.64%
9
Chelsea Handler17.22%
10 Christina Aguilera16.67%

In addition to Jimmy Kimmel (No. 1) and Chelsea Handler (No. 9), a number of funny people made McAfee’s top fifty risky celebrities list. Other notable comedians in the riskiest top 50 include Jimmy Fallon (No. 12), Adam Sandler (No. 14), Jason Segel (No. 19), Wee Man (No. 35), and Cameron Diaz (No. 41).

Risky musicians

The music industry is also well represented in the McAfee top 10 riskiest with  Armin van Buuren (No.2), Ciara (No. 3), Flo Rida (No. 4), Bruce Springsteen (5), Blake Shelton (No.6), Jon Bon Jovi (No.8).

Bruce Springsteen one of 2016s most dangerous celeb onlineOther musicians in McAfee’s riskiest 50 are 50 Cent (No. 13), Cheryl Cole (No. 16) Calvin Harris (No. 17) and Iggy Azalea (No. 20). Additional superstars heating up the McAfee top 50 are Jason Derulo (No. 24), Jay Z (No. 26), Chris Brown (No. 28), Paul McCartney (No.29), Jennifer Lopez (No. 31), Pitbull (No. 34), Jessie J (No.44), Rihanna (No.45), Justin Timberlake (No.46), Carrie Underwood (No.47), and Pharrell Williams (No. 49).

rb-

I have covered these tidbits for a while and one sign of hope for humanity is that last year, searching for downloads of Kanye West, Kourtney Kardashian, Kim Kardashian, Khloe Kardashian, and Kris Jenner were popular among Americans. This year, the Kardashian clan is nowhere to be found.

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: , , , , , , , , , ,
« Older Entries   Recent Entries »