Documentary Screening: Terms and Conditions May Apply

Please join Technology Services for a screening of the critically acclaimed data privacy documentary Terms and Conditions May Apply.

Friday, February 14, 2014
11:30a-1:00p
Atkins-Holman Student Commons

Admit it: you don't really read the endless terms and conditions connected to every website you visit, phone call you make, or app you download. But every day, billion-dollar corporations are learning more about your interests, your friends and family, your finances, and your secrets, and they're not only selling the information to the highest bidder, but also sharing it with the government. And you agreed to all of it. This disquieting expose demonstrates how every one of us is incrementally opting-in to a real time surveillance state, click-by-click--and what, if anything, you can do about it.

Data Privacy Day--January 28th

The weakest link in data privacy is, well, you
by Frank Catalano

Happy Data Privacy Day! The first round of credit card numbers is on me!

Yes, this is Tuesday, Jan. 28 really is Data Privacy Day in the U.S. and Canada, commemorating the 1981 signing of Convention 108, an international treaty dealing with privacy and data protection. (In Europe, where it originated, it's known as Data Protection Day.)

Safeguarding one's personal data may seem Sisyphusian in the wake of enterprise-level consumer breaches like those recently at Target and Neiman Marcus. But if you, like me, are concerned, I’ve found it helps to unpack the concept of good personal data hygiene into three elements, each with increasing levels of individual control.

After all, to paraphrase and extend Joseph Heller’s Catch-22 observation, if everyone truly is after your personal information, paranoia is just a good strategy. (No matter how much one might whine about password problems.)

Allow me to over-simplify.

1) Security. This is how well-protected the data is wherever it is stored, largely a technology issue. You, personally (unless you work for the NSA), pretty much are SOL on this, unless you understand data transfer protocols, encryption standards, authentication methods, and can direct which of each is used by an organization that holds your personal information.

Forrester Research recently weighed in on the authentication (that is, proving to the system that you are who you say you are, and that you have the right to get in) part in a dizzying-yet-compact report, “Employee and Customer Authentication Solutions,” that bluntly states, “Current user authentication methods are failing organizations badly.” Rather than concluding that entropy will win, it hopefully points to a “massive third generation of innovation” including the rise of smart mobile device methods, and the concept of “responsive design” for authentication that takes into account how someone is accessing the system, any contextual clues as to legitimacy, and overall risk.

It’s somewhat like how TSA determines a traveler is qualified for an expedited security PreCheck, but without the full-body-massage fallback.

2) Privacy. This is less about technical protection, and more about what can be done with the data and how selectively it’s shared, turning it from a technology to a policy matter. And “policy” means groups of sadly fallible humans making rules, whether they’re expressed as government regulations, vendor contracts or Facebook’s ever-morphing terms of use.

Individuals have – and want – more influence here. Nonprofit Common Sense Media this month released a national survey that shows, for example, 90% of U.S. adults are concerned about how “non-educational interests” might be able to get to and use personal information about students. Whether those “interests” actually could get or use it (or even want to) is a separate but equally important matter. Still, another study done by Fordham University notes that a “sizeable plurality” of school districts using web-based services for student data had contract gaps, such as missing privacy policies. (Interestingly, Microsoft helped underwrite this study.) Not to mention that kids interact with consumer sites and apps outside of a school environment.

Apparently a few parents and school administrators may need to study up on tech, or perhaps contract law. As might anyone who relies on another party to store personal information, to make sure assumptions are backed up by documented assurances.

3) Practice. The third element effectively is a mash-up of the first two: how well they are implemented under real-world conditions. And here is where the individual is in the most control and, if recent reports on self-inflicted injuries are any indication, is the most screwed.

A summary of the 2013 IT Risk/Reward Barometer from ISACA (an association of information security professionals) finds that while nine out of ten of us worry that our information will be stolen, half of us use the same two or three passwords across multiple accounts and websites.

While it’s true that many sites don’t make remembering strong passwords easy due to maddening inconsistencies across sites and even across platforms used for a single account, there is no excuse for using, say, what security firm SplashData called the Worst Password of 2013 (123456) or any of the runners-up (password, 12345678, qwerty). These are actual user passwords revealed as the results of data breaches. You know who you are.

It’s similar to how some website administrators never changed the default webserver login from “admin,” and then wondered why their sites were hacked. That happened, too.

So is there any hope that developments in security can help address practice, the weakest individual human link in personal data safety? Especially since we are, by nature, lazy and easily bump up against what we consider tolerable demands on convenience and memory?

“When technology arises that offers direct privacy and security benefits that individuals value, along with removing user experience friction in achieving it, then we’ll see uptake,” observes Eve Maler, who, as principal analyst for security and risk, co-authored the recent Forrester Research report. Responsive design in authentication is one reason for optimism: “The whole goal is inconveniencing the good guys the least, and the bad guys the most,” she says.

Some of those technologies will include our current BFFs, smartphones (such as approaches like PassQi’s, which uses iPhones, QR codes and bookmarklets to authenticate us with sites we choose – and gently advises us to avoid bad or duplicated site passwords). Just remember to also lock said smartphone’s screen, too, with a thumbprint or PIN.

But personal information is not safeguarded in isolation. Rock-solid technology and vigilant practice fails when confronted with a leaky policy for privacy. If you don’t address all three, you’re not really addressing it at all.

Or, to paraphrase another great literary figure, Pogo: We have met the enemy when it comes to personal data safeguards. And he is us.

Data Privacy Month

Data Privacy Month (DPM) is an annual effort to empower people to protect their privacy and control their digital footprint, as well as escalate the protection of privacy and data as everyone's priority. Data Privacy Month will be celebrated in 2014 starting with Data Privacy day on January 28 and running through February 28. Spend the month helping to ensure your campus community is respecting privacy, safeguarding data, and enabling trust.

Data flows freely in today's online world. Everyone--from home computer users to multinational corporations--needs to be aware of the personal data others have entrusted to them and remain vigilant and proactive about protecting it. Being a good online citizen means practicing conscientious data stewardship. Data Privacy Day (January 28th) is an effort to empower and educate people to protect their privacy, control their digital footprint, and  make the protection of privacy and data a great priority in their lives.

Data Privacy Day is led by the National Cyber Security Alliance, a nonprofit, public-private partnership dedicated to cybersecurity education and awareness, and advised by a distinguished advisory committee of privacy professionals.

http://www.staysafeonline.org/data-privacy-day/about/ 

Securing your Home Network

Home networks were relatively simple years ago, perhaps nothing more than a wireless access point and computer or two used to surf the internet or play games online. However, home networks have become increasingly complex. Not only are we connecting more devices to our home networks, but we are doing more things with them. In the January 2014 edition of SANS monthly security awareness newsletter for computer users, OUCH, SANS offers some basic steps for creating a more secure home network.

To view the full newsletter, click here: http://www.securingthehuman.org/newsletters/ouch/issues/OUCH-201401_en.pdf .

Hackers hijacking free Wi-Fi, especially at airports

Better Business Bureau
Posted: Tuesday, November 26, 2013 9:15 a.m.

Everywhere you look these days, you see people using their electronic gadgets: smartphones, tablets, gaming systems, and e-readers. Most of these gadgets require Wi-Fi to access the Internet or the gadget itself is a Wi-Fi hotspot. May airports and other public spaces offer Wi-Fi for the public to log onto the internet from their laptop computers.

"Hackers are now taking advantage of travelers who want to stay connected," said BBB President Tom Bartholomy. "They are setting up fake Wi-Fi connections designed to steal your personal information without you even knowing it."

How it works:

Although hackers have set up fake Wi-Fi connections in many locations, airports are a favorite hot spot. When searching for connections, consumers may see a network connection available that could simply be named "Free Wi-Fi."

Unfortunately, the network may actually be an ad-hoc network, or a peer-to-peer connection. The user will be able to surf the internet, but they are doing it through a hacker's computer.

"While the user is online, the hacker is stealing information like passwords, credit card and bank account numbers, and social security numbers from the user's laptop computers," said Bartholomy. "Airports across the nation continue to report Wi-Fi security issues."

The BBB offers the following advice for travelers using Wi-Fi hotspots:

• Connect securely. Never connect to an unfamiliar wireless network--even if the name sounds genuine. A hacker can change the name of his network to anything he wants, including the name of the legitimate Internet connection offered by the airport.
• Disable automatic connections. Make sure that your computer is not set up to automatically connect to any wireless networks in your range. Otherwise, your computer could automatically connect to the hacker's network without your knowledge.
• Turn off file sharing when you are on the road to prevent hackers from stealing sensitive data from your computer. Turn off the Wi-Fi hotspot on your device so others cannot sign in to your network. 
• Create a Virtual Private Network (VPN). A VPN establishs a private network across the public network which prevents a hacker from intercepting your data. If your mobile device has a Wi-Fi hotspot feature, you definitely need a VPN to prevent other people from accessing the internet via your mobile device.

For more information, please visit BBB or cal 1-877-317-7236 toll free in N.C. and S.C.

http://www.salisburypost.com/article/20131126/SP01/131129767/

Target confirms massive credit-card data breach

Melanie Eversley and Kim Hjelmgaard, USA Today
8:29am EST December 19, 2013

Target says that its stores have been hit by a  major credit-card attack involving up to 40 million accounts.

Chief Executive Officer Greg Steinhafel confirmed Thursday morning earlier reports that a brazen data breach had taken place. In a statement, Steinhafel said "Target is working closely with law enforcement and financial institutions, and has identified and resolved the issue."

The retailer said that the unlawful access to customer information took place between November 27 and December 15.

Earlier, the Secret Service confirmed to USA TODAY that it is investigating the massive data violation involving shoppers' personal credit-card information.

The Secret Service will confirm it is investigating the incident at Target," spokesman Brian Leary said in telephone interview Wednesday night. "We don't have any further comment because its an ongoing investigation."

The breach began around Black Friday, the day after Thanksgiving and the busiest shopping day of the year.

The breach involves the theft of information stored on the magnetic stripe on the backs of cards used at nearly all of Target's stores around the country, according to the Krebs on Security website, who first reported the news.

KrebsOnSecurity.com is the website of Brian Krebs, a national computer security expert and former Washington Post reporter.

Target is based in Minneapolis and has almost 1,800 stores in the United States and 124 in Canada, according to its website.

James Issokson, vice president of MasterCard communications, said in an email to USA TODAY that a question regarding the potential breach "at this point is best directed to Target."

An expert with a global firm that helps companies respond to and mitigate breaches said while he could not address the Target situation specifically, many companies--large and small--are typically under-prepared when they face a breach.

Most important is that the potential breach be addressed quickly, to help get information out to those affected and to regulators, to bring in the right experts to address the breach (such as forensic experts who can stop cyber attacks) and to help preserve the public's trust in the company, said Mike Donovan, Global Focus Group Leader for Beazley Breach Response, headquartered in London.

"We see breaches across all sizes of companies," said Donovan, who is based in San Francisco. "You see the stories about the big ones in the news, but breaches are affecting companies all across the board."

Beazley recently responded to its 1000th breach and the company has seen a "significant number" of large breaches in the last four or five years, Donovan said.

It happens all the time, every day, with retailers, health care organizations, schools, and other operations, he said.

"Any company that handles personal data is vulnerable," Donovan said.

The potential breach does not appear to involve online purchases, Krebs reports. It appears the type of data stolen would allow thieves to create counterfeit credit cards and, if pin numbers were intercepted, would also allow thieves to withdraw cash from ATM machines, according to Krebs.

Visa did not respond to emails or telephone messages left with its corporate office.

How to Secure and Maintain your New Tablet

With the holidays just around the corner, many people and their family members will be receiving new tablets. With this comes the perfect opportunity to start learning about and securing your mobile devices. Check out SANS December issue of OUCH!, Securing your New Tablet here.

http://www.securingthehuman.org/newsletters/ouch/issues/OUCH-201312_en.pdf

Nasty new malware locks your files forever, unless you pay ransom

Herb Weisbaum
NBC News contributor
November 6, 2013 at 10:29 AM ET

CryptoLocker, a new and nasty piece of malicious software is infecting computers around the world--encrypting important files and demanding a ransom to unlock them.

According to Sophos, the worldwide digital security company, it's been hitting pretty hard for the past six weeks or so. 

"It systematically hunts down every one of your person files--documents, databases, spreadsheets, photos, videos and music collections--and encrypts them with military-grade encryption and only the crooks can open it," said Chester Wisniewski, a senior security advisor at Sophos.

Even though it's infected, your computer keeps working normally; you just can't access any of your personal files. It's scary, especially if you haven't backed up your data. 

"Cybercrime is evolving, as the bad guys get smarter and use newer technologies," noted Michael Kaiser, executive director of the National Cyber Security Alliance. "They're always looking for new ways to steal your money."

CryptoLocker is different from other types of "ransomware" that have been around for many years now that freeze your computer and demand payment. They can usually be removed which restores access to your files and documents.

Not CryptoLocker--it encrypts your files. There's only one decryption key and the bad guys have that on their server. Unless you pay the ransom--within three days, that key will be destroyed. And as the message from the extorters says "After that, nobody and never will be able to restore files...".

The typical extortion payment is $300 USB or 300 EUR paid by Green Dot MoneyPak, or for the more tech savvy, two Bitcoins, currently worth about $400.

To instill a sense of urgency, a digital clock on the screen counts down from 72 hours to show how much time is left before that unique decryption key is destroyed.

One victim described his anguish in an online post: "The virus cleverly targeted all of our family photos, including all photos of my children growing up over the last 8 years. I have a distraught wife who blames me!"

This sophisticated malware is delivered the old-fashioned way--an executable file hidden inside an attachment that looks like an ordinary ZIP file or PDF. One small business reports being compromised after clicking on an email attachment that was designed to look like a shipping invoice from the U.S. Postal Service.

Open that file and bad things start to happen, although it may take several days for the ransom demand to pop up on your screen after the machine is infected.

“The author or this (malware) is a genius. Evil genius, but genius none the less,” an IT professional commented in an online tech forum. Another wrote, “This thing is nasty and has the potential to do enormous amounts of damage worldwide.”

Good anti-virus software can remove the CryptoLocker malware from your computer, but it cannot undo the damage – the encryption is that good.

“It’s the same type of encryption used in the commercial sector that’s approved by the federal government,” Wisniewski told me. “If the crooks delete that encryption key, your files are gone forever – even the NSA can’t bring them back.”

Victims large and small

The cyber-crooks are targeting both businesses and individual computer users – anyone who will pay to regain access to their files.

The CryptoLocker forum on BleepingComputer.com is filled with page after page of horror stories. Here is a small sample:

“When we discovered the infection from a user’s workstation on the network, this program had encrypted over 180,000 files through the network shares in a period of 6 days. I pretty much shut down the business for 2 days after we realized what was happening.”

“Our company was infected this morning. The virus hit a machine 4 days ago and today we got the pop up about the ransom. All files on the network drive the user had access to are now encrypted.”

“We had a workstation get infected yesterday that encrypted everything on our network share drive. We had backups, although they weren’t recent enough, so despite all feelings against it, we paid the ransom and everything started to decrypt overnight.”

Of course, there’s no guarantee there will be a happy ending if you pay the ransom. And then there’s the bigger issue – by doing this, you’re helping fund a criminal operation.

“It encourages them to continue this bad behavior,” said Howard Schmidt, former White House Cyber Security Advisor and a co-founder of Ridge-Schmidt Cyber. “As people pay the ransom, the bad guys have the money to reinvest in create research that are more virulent and hide better from detection.”

How to protect yourself

Go on the Internet and there’s no way to guarantee malware won’t make it onto your computer – even if you follow all the rules of safe computing. So you need to act defensively, and that means regular backups.

“Backup, back, up, back up,” said Schmidt. “That’s the only way to reduce the risk of losing your files forever.”

If you have a recent backup, you can recover from CryptoLocker and other malware with no serious consequences. That backup should be a snapshot of everything on the system and not a simple synchronization, as happens with most automated external hard drives and many cloud-based services.

With these synchronized backups, stored files that have changed on the master drive are overwritten with the new ones. If a malicious program encrypts your master files, those backups would also be encrypted – and useless. Your backup should be disconnected from your computer until the next time you need to access it.

http://www.today.com/money/nasty-new-malware-locks-your-files-forever-unless-you-pay-8C11511655?ocid=ansmsnbc11

Apple's iCloud cracked: Lack of two-factor authentication allows remote data download

By Violet Blue for Zero Day

Notorious Russian hacker Vladimir Katalov released findings showing Apple's iCloud vulnerable to unauthorized download access, with iCloud data stored on Microsoft and Amazon servers.

KUALA LUMPUR, MALAYSIA--Russian security researcher Vladimir Katalov analyzed Apple's secretive iCloud and Find My iPhone protocols to discover that neither are protected by two-factor authentication, and iCloud data can be downloaded remotely without a user ever knowing. 

In "Cracking and Analyzing Apple’s iCloud Protocols," presented to a crowded room at Hack In The Box security conference last Thursday in Kuala Lumpr, Malaysia, Vladimir Katalov revealed that user information and data is not as inaccessible as Apple is telling the public.

Katalov's findings appear to support his emphatic statement that Apple can access data it claims to not be able to access.

A malicious attacker only needs an Apple ID and password to perform remote iCloud backups — and do not need the user's linked devices.

He explained that there is no way for a user to encrypt their iCloud backups.

The data is encrypted, he explained, but the keys are stored with the data. Katalov added that Apple holds the encryption keys.

Katalov told ZDNet he was shocked to discover that in addition to all of these security chain issues, Apple's iCloud data is stored on Microsoft and Amazon servers.

Katalov's presentation pointed out that because Apple provides full request information to its third-party storage providers (Amazon and Microsoft), Apple could provide this data to law enforcement. 

In Apple's July public statement on the NSA PRISM surveillance program, Apple denied any backdoor server access for government agencies. Apple unequivocally stated, "Apple does not give law enforcement access to its servers."

When a user performs an iCloud backup download, they receive an email informing the user that the process is complete.

Katalov discovered that when a remote download is performed, the user receives no notification email. If a user's data is accessed and downloaded from iCloud by a remote third party, they would not know.

Katalov's work represents the first time anyone has analyzed and publicly presented findings on Apple's secretive iCloud protocol.

Vladimir Katalov analyzed Apple's iCloud and Find My Phone protocols by sniffing http traffic on jailbroken devices — though he was careful to explain that a user's devices do not need to be jailbroken for a malicious entity to exploit the remote backup protocol security omissions Katalov discovered.

Analyzing the traffic, he told the crowded room during his Thursday presentation, was not difficult.

Apple's iCloud data is comprised of what a user stores as a data backup. It contains documents, Dropbox files and sensitive user data.

In his analysis, Katalov discovered that iCloud files are stored as a container — plist and content— in a files-to-chunks mapping schema.

But he found that Apple's two-factor authentication, a layer of user security used in addition to a username and password, is not used for iCloud backups (or Find My Phone).

Apple's two-step authentication ("2FA") does not protect iCloud backups, Find My Phone data and the documents stored in the cloud. Katalov details this further in a blog post: "Apple Two-Factor Authentication and the iCloud."

Katalov showed Hack In The Box attendees that with simple queries, it's possible to get the authentication token for accessing the iCloud backup, backup IDs, and the encryption keys. Then one can download the files from where they're stored in Windows Azure or Amazon AWS.

ZDNet caught up with Katalov after his presentation to find out more.

When asked if he had presented his discoveries to Apple, he explained that his findings were the results of protocol analysis — and are not a vulnerability.

Put another way, the iCloud security hole falls into the "it's a feature, not a bug" category.

When ZDNet asked Katalov if there was a way for Apple to fix this issue — such as extending two-factor authentication to its iCloud and Find My Phone services — he shook his head and told us that Apple's implementation of two-factor auth was likely "only an afterthought."

Katalov told ZDNet the best thing a user can to do to protect their iCloud data is to simply not use iCloud.

However, Katalov told us he still uses Apple's iCloud as a backup service. "It is not exactly safe, but I am selecting between security and privacy," he said.

It's easy to argue that because a remote attacker needs an Apple user ID and password, the data is still out of reach to most malicious entities.

However, obtaining Apple user IDs and passwords isn't impossible — aside from email phishing techniques, which are more effective than most would believe. Social engineering techniques are sadly common and also very effective.

A recent example is the spate of Apple ID data thefts in Norway. This past February, a significant number of teenage girls were targeted by boys who easily surmised the girl's user ID and password recovery information to gain access to their Apple accounts, download photos and the girls' data — which, sadly, ended up pass around and also sold online.

In his Hack In The Box presentation, Katalov told the audience that he was also surprised to discover that when a user shuts off location tracking services, the user's location is still stored for around 3-6 hours.

We wondered if this is what led Katalov to mention that next he will analyze Touch ID protocol and storage — as soon as iOS 7 is jailbroken, he told ZDNet.

"Apple says it never sends the information, and it is never copied to local [storage]" he added, "but I am not so sure."

ZDNet asked why Katalov felt this way, when Apple specifically states that it does not transmit Touch ID information.

Katalov's eyes glittered, and a boyish smile crept across his face. In his thick Russian accent he replied, "Trust no one."

ZDNet has contacted Apple for comment and will update this article if Apple responds.

http://www.zdnet.com/apples-icloud-cracked-lack-of-two-factor-authentication-allows-remote-download-7000022196/?s_cid=e589&ttag=e589 

Columbia College Shred Event!

Please join Technology Services and New World Recycling for an opportunity to shred all your unwanted documents FREE OF CHARGE. Visit us Monday, October 28th from 1:00 to 4:00pm on Cougar Drive (behind the mail room) to shred your documents, get tips on identity theft prevention, and celebrate Halloween with Technology Services!

You Google Yourself, and That's Okay

By Peter Kafka

The Internet is great because it opens up new vistas, letting you learn all sorts of stuff about people and things in far-flung corners of the world.

And also, you can Google yourself.

Which lost of you do; 56 percent of Web users told Pew Researchers last spring that they "self-search."

That's down slightly from 2009, but up from 22 percent in 2001, when maybe people were preoccupied watching Jon Woo/Clive Owen BMW adds.

But if you feel at all embarrassed about your preoccupation with yourself, this may make you feel better: Self-searchers tend to be younger, better-educated and more affluent than the general population.

http://allthingsd.com/20130930/you-google-yourself-and-thats-ok/