Independent – Page 146 – Computer Security Articles

Credit to Author: Matthew Finnegan| Date: Mon, 18 Mar 2019 09:28:00 -0700

Slack has given large business customers control over the keys used to encrypt and decrypt data created in its team collaboration application.

The enterprise key management (EKM) feature was initially unveiled at the company’s Frontiers event in San Francisco in September, ahead of a closed pilot project; it is now available to all customers of Enterprise Grid, which is targeted at company-wide deployments at large organizations.

To read this article in full, please click here

Independent Krebs

March 17, 2019 admin

Why Phone Numbers Stink As Identity Proof

Credit to Author: BrianKrebs| Date: Sun, 17 Mar 2019 23:25:06 +0000

Phone numbers stink for security and authentication. They stink because most of us have so much invested in these digits that they’ve become de facto identities. At the same time, when you lose control over a phone number — maybe it’s hijacked by fraudsters, you got separated or divorced, or you were way late on your phone bill payments — whoever inherits that number can then be you in a lot of places online.

Independent Krebs

March 13, 2019 admin

Ad Network Sizmek Probes Account Breach

Credit to Author: BrianKrebs| Date: Wed, 13 Mar 2019 20:56:39 +0000

Online advertising firm Sizmek Inc. [NASDAQ: SZMK] says it is investigating a security incident in which a hacker was reselling access to a user account with the ability to modify ads and analytics for a number of big-name advertisers. In a recent posting to a Russian-language cybercrime forum, an individual who’s been known to sell access to hacked online accounts kicked off an auction for “the admin panel of a big American ad platform.” “You can add new users to the ad system, edit existing ones and ad offers,” the seller wrote. The starting bid was $800.

ComputerWorld Independent

March 13, 2019 admin

March 2019 Windows and Office patches poke a few interesting places

Credit to Author: Woody Leonhard| Date: Wed, 13 Mar 2019 06:21:00 -0700

Patch Tuesday has come and gone, not with a bang but a whimper. As of this moment, early Wednesday morning, I don’t see any glaring problems with the 124 patches covering 64 individually identified security holes. But the day is yet young.

There are a few patches of note.

Two zero days

Microsoft says that two of this month’s security holes — CVE-2019-0797 and CVE-2019-0808 — are being actively exploited. The latter of these zero days is the one that was being used in conjunction with the Chrome exploit that caused such a kerfuffle last week, with Google urging Chrome browser users to update right away, or risk the slings of nation-state hackers. If you’ve already updated Chrome (which happens automatically for almost everybody), the immediate threat has been thwarted already.

To read this article in full, please click here

Independent Krebs

March 12, 2019 admin

Patch Tuesday, March 2019 Edition

Credit to Author: BrianKrebs| Date: Wed, 13 Mar 2019 04:55:28 +0000

Microsoft on Tuesday pushed out software updates to fix more than five dozen security vulnerabilities in its Windows operating systems, Internet Explorer, Edge, Office and Sharepoint. If you (ab)use Microsoft products, it’s time once again to start thinking about getting your patches on. Malware or bad guys can remotely exploit roughly one-quarter of the flaws fixed in today’s patch batch without any help from users.

ComputerWorld Independent

March 12, 2019 admin

Apple’s Box security scare shows the risk of shadow IT

Credit to Author: Jonny Evans| Date: Tue, 12 Mar 2019 10:25:00 -0700

Until enterprise IT truly gets to understand that its own internal systems need to be as easy to use as any iOS app and as easy to learn as an iPhone, potentially damaging data breaches will take place, threatening business confidentiality. Apple is not immune.

Apple and the human interface

The news is that information from some of the world’s biggest names in business – including Apple, Edelman and Discovery Channel – could have been accessed through Box Enterprise, which offers companies bespoke company name-based file archiving and sharing services using this URL construction:

https://<companyname>.app.box.com/v/<filename>

To read this article in full, please click here

Independent Krebs

March 10, 2019 admin

Insert Skimmer + Camera Cover PIN Stealer

Credit to Author: BrianKrebs| Date: Mon, 11 Mar 2019 03:41:54 +0000

Very often the most clever component of your typical ATM skimming attack is the hidden pinhole camera used to record customers entering their PINs. These little video bandits can be hidden 100 different ways, but they’re frequently disguised as ATM security features — such as an extra PIN pad privacy cover, or an all-in-one skimmer over the green flashing card acceptance slot at the ATM. And sometimes, the scammers just hijack the security camera built into the ATM itself.

Independent Krebs

March 8, 2019 admin

MyEquifax.com Bypasses Credit Freeze PIN

Credit to Author: BrianKrebs| Date: Fri, 08 Mar 2019 16:12:38 +0000

Most people who have frozen their credit files with Equifax have been issued a numeric Personal Identification Number (PIN) which is supposed to be required before a freeze can be lifted or thawed. Unfortunately, if you don’t already have an account at the credit bureau’s new myEquifax portal, it may be simple for identity thieves to lift an existing credit freeze at Equifax and bypass the PIN armed with little more than your, name, Social Security number and birthday.