Tag Archive for Security

| December 11, 2019
Comments Off on Your Smart TV is Spying On You

Your Smart TV is Spying On You

Your Smart TV is Spying On YouMany people will find a smart TV under their tree this year. Smart TVs are like regular televisions but with an internet connection. The global smart TVs market is expected to reach 249.9M units by 2024. And all those smart TVs may be spying on you. A while ago I wrote about Vizio (VZIO) getting caught invading your privacy by collecting and selling your personal data. Despite the fact that Vizo had to pay a $2.2M fine, smart TV manufacturers continue to spy on their customers.

Data leakZDNet reports that that smart TVs send user data to tech titans including Facebook (FB), Google (GOOG), and Netflix. These devices are spying on you even when they are idle. U.S. and UK researchers say smart television sets produced by popular vendors including Samsung (005930), Apple (AAPL), and LG (LGLD), alongside content and app streaming devices such as Amazon (AMZN) FireTV, and Roku, are sending out information potentially without the knowledge or consent of users.

Smart TV's sharing users' personal data

Financial Times

Your Smart TV is Spying On You

In a paper titled, “Information Exposure From Consumer IoT Devices” (PDF), the team said that 34,586 controlled experiments found that 88% of devices send information to firms other than the device manufacturer; 56% of U.S. devices and 83.8% of UK devices send your info overseas. They also report every device they studied exposed some kind of information in plain-text.

eavesdroppingThe researchers from Northeastern University and Imperial College London found that 37% could “reliably inferred” user and device behavior from eavesdropping on the user’s interactions with television sets and other household IoT products.

The study found that almost half of the tested devices contacted Amazon. That includes devices not manufactured by Amazon. David Choffnes, one of the authors of the paper warns that Amazon has a lot of information about what you are doing in your home.

According to the paper location data and IP addresses were commonly sent by our IoT devices to third parties in the cloud including Netflix, Spotify, Microsoft (MSFT), Akamai (AKAM), and Google.

Netflix logoWhen it came to smart TVs, however, almost all of the devices included in the study would contact Netflix — whether or not a TV was configured with an account for the content streaming service. “This, at the very least, exposes information to Netflix about the model of [a] TV at a given location,” the paper reads.

Some of the tech titans collecting your data responded to the researchers.

  • Facebook said that it was “common” for services with Facebook integrated into them to send data to third-party services.
  • Netflix said that data transfers were “confined to how Netflix performs and appears on screen,” and
  • Google said user preferences and consent levels dictate how publishers “may share data with Google’s that’s similar to data used for ads in apps or on the web.”

Internet-connected smart TVs combined with streaming services like Netflix and Hulu seem to be a cord-cutter’s dream. But like anything else that connects to the internet, it opens up smart TVs to security vulnerabilities and hackers. But as is the case with most other internet-connected devices, manufacturers often don’t put security as a priority. Not only that, many smart TVs come with a camera and a microphone that attackers can access.

FBI warning

FBI issued a warning about smart TVsBecause manufacturers don’t put security as a priority, the FBI issued a warning about the risks that smart TVs pose. The FBI warned that hackers can take control of your unsecured smart TV and in worst cases, take control of the camera and microphone to watch and listen in.

… TV manufacturers and app developers may be listening and watching you, that television can also be a gateway for hackers to come into your home … your unsecured TV can give him or her an easy way in the backdoor through your router.

TechCrunch notes that some of the biggest attacks targeting smart TVs were developed by the CIA, but were stolen. The files were later published online by WikiLeaks.

rb-

If you are interested in inspecting the IoT network traffic in your smart home, Princeton University has developed and released an open source tool called IoT Inspector. The software uses ARP spoofing to analyze what IoT devices are connected to the Internet, how much data is exchanged, and how often information is traded.

Related Posts

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: , , , , , , , , , , , , , , , , , , ,
| November 30, 2019
Comments Off on RSA Available?

RSA Available?

Updated 12/26/2019 – The rumor mill says that Dell Technologies is working with too big to fail Morgan Stanley in a bid to sell off RSA Security.

—

RSA Available?

Is RSA available? In keeping with the wave of cybersecurity mergers and acquisitions the rumor mill is reporting that Dell is exploring the sale of its RSA Security business unit. If the rumors are correct, RSA can be had for at least $1 billion. Rumors about Dell potentially selling RSA have surfaced multiple times over the past few years.

RSA Security logoDell inherited RSA in 2016 as part of its $67 billion acquisition of EMC. EMC bought RSA for about $2.1 billion in 2006. RSA Security was founded in 1982.

RSA is well-known for its products. Well known products include SecurID multifactor authentication tokens and NetWitness for security incident event management and threat detection and response. However, RSA is probably best known for its annual RSA Conference in San Francisco. RSA faces many of the same issues that have precipitated the HP – Xerox face-off. The challenges include competition from fast-growing cloud and software based identity and access management (IAM) firms.  The RSA challengers include Okta and Ping Identity, according to Bloomberg.

Why is RSA Available

RSA SecurID multifactor authentication tokensDell may have put RSA on the block because it is redundant in the Dell portfolio. Dell also owns Secureworks, an MSSP that’s evolved a software-defined era led by threat detection and management services. Additionally, Dell’s VMware business now owns Carbon Black — an endpoint protection and cybersecurity company that works closely with MSSPs. Dell has been connecting the dots between Secureworks, VMware, and Carbon Black as part of its own enterprise security strategy.

Neither Dell nor RSA commented on the Bloomberg report.

rb-

As I have noted a number of times on Bach Seat, the cyber-security market is seeing lots of M&A action. If Dell is really serious about unloading RSA, now is the time to do it. Before the cyber-security bubble bursts and/or the economy tanks again. Not only would selling RSA streamline Dell’s security story the $1 billion would allow Dell to pay down its debt after its purchase of EMC or fund other projects.

Related Posts

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: , , , , , , ,
| November 16, 2019
Comments Off on Why Don’t Users Protect Themselves

Why Don’t Users Protect Themselves

Why Don't Users Protect ThemselvesA new report (PDF) from recently swallowed and swallowed again Webroot, says that American technology users overestimate their levels of cyber hygiene. Cyber hygiene is a cybersecurity risk mitigation technique introduced by Vinton Cerf in 2000 where you train yourself to think proactively about your cybersecurity. The goal is to resist cyber threats and online security issues to protect and maintain IT systems and devices and implement cybersecurity best practices, just as you do with your daily personal hygiene.

Webroot logoThe report says U.S. users do not know how to protect themselves from cyber threats. Americans are overconfident in the perceived protection they have. The endpoint security and threat intelligence provider found that 88% of interviewed Americans believe they are taking the appropriate steps to protect themselves from cyber-attacks.

Their confidence is misplaced. Instead, Americans have only a surface-level understanding of the most common types of cyber threats according to Webroot. We can recognize some of the names of the most common cyber-attacks such as malware (79%) or phishing (70%), but for most, that’s where their knowledge ends. Very few (less than 1 in 3) actually know what these common cyber-attacks are or what they do.

While Americans claim to have heard of some of the most common cyber-attack terms when prompted, very few actually understand what those cyber-attacks are. When asked about critical cyber-hygiene issues like malware, backups passwords, and identity theft surveyed Americans reported:

20% update their AV software regularlyMalware – 79% have heard of malware, but only 28% can confidently explain what it is. 82% are using some sort of AV software on their personal devices. 62% of those who use AV software use a free product. Only 20% update their AV software each time they are prompted.

Backups – are another weakness. 78% of respondents report backing up their data. However, 57% are still leaving themselves susceptible to risk by only backing up using one method, rather than backing up online (cloud) and offline.

  • 22% rarely or never backup their data.34% Automatically backup to the cloud
  • 27% Backup to an external hard drive
  • 24% Backup to a USB stick
  • 22$ backup locally on My Computer
  • 17% backup manually to the cloud
  • 22% rarely or never back up their data.

Among those who are backing up their information by uploading it to the cloud, only 43% are taking the extra step in ensuring that it’s stored in an encrypted format.

33% of Americans admit to sharing their passwordsPasswords – Followers of Bach Seat know that passwords suck and the Webroot report confirms it. 33% of Americans admit to sharing their passwords with others. To make matters worse, 63% are reusing passwords across multiple accounts. The research found that Americans have on average 9 passwords for 17 accounts.

Mobile – While on the go, 67% of Americans use public Wi-Fi, but only 35% take the extra step to protect themselves by using a VPN. Additionally, 34% use a work device as their primary personal device at home.

Identity theft 74% of Americans believe their identity stolen has never been stolen.

According to the Webroot whitepaper, the 5 most cyber risky U.S. states are:

  1. Mississippi most cyber risky stateMississippi
  2. Louisiana
  3. California
  4. Alaska
  5. Connecticut

The 5 least risky U.S. states are

  1. New Hampshire least cyber risky stateNew Hampshire
  2. North Dakota
  3. Ohio
  4. Idaho
  5. Kentucky

rb-

According to the research conducted by Wakefield for Webroot, Michigan ranked 31 among the 50 states. Overall, the average home user scored a 60% for cyber-hygiene. The researchers also found that those who they classified as “Superstars” tended to be:

  • A Boomer
  • Married or in a relationship
  • Suburbanite
  • Not a parent.

Related article

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: , , , , , , , , , ,
| November 1, 2019
Comments Off on Celebrities You Shouldn’t Google in 2019

Celebrities You Shouldn’t Google in 2019

Celebrities You Shouldn't Google in 2019It is time once again for McAfee’s annual search for the most dangerous celebrity online. The 2019 version of the cyber-security firm’s research found which celebrities’ internet searches expose users to the most risk from malicious websites, malware, and ransomware, and other risky outcomes. McAfee says that criminals use deceptive websites to dupe unsuspecting consumers into accessing malicious files or content.

McAfee logoMcAfee crowned actress Alexis Bledel the riskiest celeb online for 2019. Searches for the actress, known for her role as Rory Gilmore. in the TV show Gilmore Girls landed the most users on risky websites that carry viruses or malware in 2019.

McAfee speculates that the Texas-born Bledel’s role as Ofglen in the fan-favorite Hulu series “The Handmaid’s Tale” and big-screen role in the “Sisterhood of the Traveling Pants” movies led to her top ranking.

Alexis Bledel is McAfees 2019 riskiest celeb onlineThe actress takes over the number one spot from Ruby Rose, who topped last year’s list mainly because of fans’ interest in her playing Batwoman.

The second most dangerous celebrity online was British comedian and actor and host of the Late Late Night show, James Corden. The popularity of viral videos from the Late Late Show gives attackers more options to spread their malware.

Sophie Turner made the list at number 3. She has been trending lately due to her role on “Game of Thrones,” as well as her relationship with singer Joe Jonas.

Lupita Nyong'o is McAfees 5th riskiest celeb onlinePitch Perfect series’ actress Anna Kendrick reached 4th place.  She was followed by Lupita Nyong’o as the 5th riskiest position on the risky celebrity list. McAfee speculates that interest in “Star Wars: The Rise of Skywalker” put Ms. Nyong’o on the list.

Comedian, former SNL star, and current Tonight Show host Jimmy Fallon is ranked number 6. Viral videos from Tonight Show are popular with threat actors.

Martial arts master Jackie Chan, who came in at 7. McAfee  explained that rumors circulated about his return to the big screen in “Rush Hour 4” and “The Karate Kid 2.” His team denied the gossip, but cyber-criminals took advantage of fans’ nostalgia to spread their malware.

Rappers take the #8 and 9 positions on McAfee’s list. Lil Wayne was named the eighth most dangerous driven by his summer tour with Blink-182  and fans search for illegal downloads. Nicki Minaj came in at 9. She caused many of her fans to panic in September after she tweeted she was retiring from music and attackers took advantage of her fans’ quest for more information by poisoning her searches.

Tessa Thompson is McAfees 10th riskiest celeb onlineTessa Thompson, known for her role as Valkyrie, Marvel’s first LGBTQ superhero, was listed as the number 10 riskiest popular search term this year thanks to her leading roles in “Men in Black: International” and “Avengers: Endgame.”

Cyber-criminals also use the same celebrity-baiting tactics internationally. According to McAfee, the most dangerous online celebs around the world are:

Gary Davis, chief consumer security evangelist at McAfee explained the risks involved with searches for these celebrities.

Camila Cabello is McAfees riskiest celeb online in SpainConsumers may not be fully aware that the searches they conduct pose risk, nor may they understand the detrimental effects that can occur when personal information is compromised in exchange for access to their favorite celebrities, movies, TV shows, or music

He warns celebrity seekers to be cautious.

It is essential that consumers learn to protect their digital lives from lurking cyber-criminals by thinking twice before they click on suspicious links or download content.

rb-

Cord-cutting could be driving some of this risky behavior. McAfee found that the names of the risky celebs like Bledel, Fallon, and Chan are strongly associated with searches including the term “torrent.”

These users are bypassing the subscription services like Hulu and Amazon to save a few bucks put their digital lives at risk in exchange for pirated content.

Related article

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: , , , , , , , ,
| October 20, 2019
Comments Off on VC Buys Sophos – Start of Bubble?

VC Buys Sophos – Start of Bubble?

Cyber-security firm SophosVC Buys Sophos - Start of Bubble? has been acquired by private equity firm Thoma Bravo for $3.9 billion. The firms disclosed the deal on Oct 14, 2019. Sophos Group (SOPH.L) was founded in 1985 and is a FTSE 250 company. The cybersecurity firm is based in Abingdon near Oxford and employs 3,400 people. Sophos has 400,000 clients around the world including Pixar, Ford, Under Armour, Northrop Grumman, and Toshiba.

Sophos logoThe Sophos board accepted the deal and would unanimously recommend the offer from Thoma Bravo. The deal is subject to shareholder approval. Some speculate that the timing of the deal is to take advantage of the pound’s weakness around BREXIT.

The deal continues Thoma Bravo’s buying spree gathering technology companies that offer cybersecurity and business management tools. Thoma Bravo also has ownership stakes in cyber-security firms Barracuda Networks, Imperva, McAfee, and Veracode and remote managing and management (RMM) firms ConnectWise, Continuum, SolarWinds, and LogRhythm, among others. It is the first acquisition outside the U.S. for the Chicago-based buyout firm.

Thoma Bravo logoThe Sophos acquisition is one of many transactions affecting the endpoint security market, which is consolidating. Rik Turner, the principal analyst at Ovum, told Dark Reading, “There are probably too many vendors coming at this market in different ways, so a degree of simplification is in order.”

Among some of the notable endpoint deals thus far are VMware‘s acquisition of Carbon Black, Blackberry‘s purchase of Cylance, and HP’s acquisition of Bromium, for example.

Bubble burstSo the question is the cybersecurity space in a bubble? Have valuations and VC investments grown too rich? TechCrunch recently wrote that security may be in a bubble, but it is not about to burst. Here are the arguments they laid out.

TechCrunch explains the bubble part of the equation is building:

The landscape of cybersecurity solutions and services is strikingly saturated. Still, this busy frontier continues to attract founders and investors alike, with 300+ new startups launching every year and VCs investing in cybersecurity at a record high of $5.3 billion in 2018. Further, many cybersecurity startups are able to raise large rounds of funding, with exceedingly high valuations, despite having little market traction.

However, the demand side of the equation is also growing and shifting according to TechCrunch:

The global cybersecurity market is booming: Cybersecurity-related spending is on track to surpass $133 billion in 2022, and the market has grown more than 30x in 13 years. Moreover, security is often integrated into new business initiatives and used as a competitive advantage.

rb-

The dot bomb eraI wonder what the looming Trump trade-war-induced recession will do to the cyber-security bubble. We know that consolidator means job losses and recessions men more jobs are lost. To quote the great American philosopher Yogi Bera – It’s déjà vu all over again for those of us who lived thru Webvan and dot-bomb.

Related articles
  • What Happens To Enterprises If the Cybersecurity Bubble Pops? (ITSP Magazine)

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: , , , , ,
« Older Entries   Recent Entries »