Independent – Page 92 – Computer Security Articles

Credit to Author: Evan Schuman| Date: Tue, 03 Mar 2020 03:00:00 -0800

Amazon is experimenting with a way to allow shoppers to use a palm-print biometric to authenticate payments and to do so in physical stores far beyond Amazon-owned brick-and-mortars, (Whole Foods, AmazonGo, AmazonBooks, Amazon 4-Star and Amazon Pop-Up). Amazon is reportedly looking at QSRs (quick-service restaurants), especially coffee shops.

Palm prints have several advantages over more popular mobile biometric methods, such as fingerprint (prescription drugs, cleaning chemicals, burns and various other things can interfere with fingerprint readings) and facial recognition (finicky method that requires the face to be a precise distance from the scanner — not an inch too close or too far — and can suffer from hair growth, lighting, cosmetic changes, some sunglasses, as well as giving false positives to close relatives). And unlike my favorite biometric for security (retina scan), it’s far less invasive. It’s fairly accurate, convenient and (other than forcing customers to remove gloves, which could be a problem with outdoor shops in the winter) should be well-received.

To read this article in full, please click here

Independent Krebs

March 2, 2020 admin

French Firms Rocked by Kasbah Hacker?

Credit to Author: BrianKrebs| Date: Mon, 02 Mar 2020 18:07:16 +0000

A large number of French critical infrastructure firms were hacked as part of an extended malware campaign that appears to have been orchestrated by at least one attacker based in Morocco, KrebsOnSecurity has learned. The individual thought to be involved has earned accolades from the likes of Apple, Dell, and Microsoft for helping to find and fix security vulnerabilities in their products.

ComputerWorld Independent

March 2, 2020 admin

Memory-Lane Monday: The cruelest password

Credit to Author: Sharky| Date: Mon, 02 Mar 2020 03:00:00 -0800

After a network manager unexpectedly tightens up the rules for passwords and forces the expiration of all user passwords on the main application system, calls flood into the help desk, reports a pilot fish on the scene. They’re having trouble because of the new complexity rules.

One of the calls:

User: I can’t seem to change my password.

Help desk tech: Your new password needs to contain letters, numbers and punctuation. Do not use any words such as you’d find in a dictionary.

User: OK. (Pause.) No, it still won’t let me change it.

Tech: What is the password you are trying to use?

User: April.

Tech: “April” is a word.

To read this article in full, please click here

Independent Krebs

February 28, 2020 admin

FCC Proposes to Fine Wireless Carriers $200M for Selling Customer Location Data

Credit to Author: BrianKrebs| Date: Fri, 28 Feb 2020 22:12:10 +0000

The U.S. Federal Communications Commission (FCC) today proposed fines of more than $200 million against the nation’s four largest wireless carriers for selling access to their customers’ location information without taking adequate precautions to prevent unauthorized access to that data. While the fines would be among the largest the FCC has ever levied, critics say the penalties don’t go far enough to deter wireless carriers from continuing to sell customer location data.

ComputerWorld Independent

February 27, 2020 admin

How and why you need HomeKit-secured smart homes

Credit to Author: Jonny Evans| Date: Thu, 27 Feb 2020 04:40:00 -0800

Once upon a time the Internet was amazing, enabling niche interests and connecting people. Apple’s iMac was the epitome of the era, while the iPhone became the prophet of change.

What is HomeKit-secured and why should you use it?

These days hackers break into home networks using our routers and smart home devices, which is why everyone must learn how to use HomeKit-secured routers to keep their connected homes safe.

Apple announced HomeKit-secured routers at WWDC 2019. The first few devices to support the tech recently began to reach market, including options from Linksys and (now) Amazon’s Eero routers.

To read this article in full, please click here

ComputerWorld Independent

February 26, 2020 admin

Firefox starts switching on DNS-over-HTTPS to encrypt lookups, stymie tracking

Credit to Author: Gregg Keizer| Date: Wed, 26 Feb 2020 11:11:00 -0800

Mozilla has started to turn on DNS-over-HTTPS, or DoH, as part of its overall strategy of stressing user privacy.

“We know that unencrypted DNS is not only vulnerable to spying but is being exploited,” wrote Selena Deckelmann, Mozilla’s new vice president of desktop Firefox, in a Feb. 25 post to a company blog. “We are helping…to make the shift to more secure alternatives [and] do this by performing DNS lookups in an encrypted HTTPS connection. This helps hide your browsing history from attackers on the network, helps prevent data collection by third parties on the network that ties your computer to websites you visit.”

To read this article in full, please click here

ComputerWorld Independent

February 26, 2020 admin

Microsoft Patch Alert: February 2020 patches bring fire and ice but seem to have settled – finally.

Credit to Author: Woody Leonhard| Date: Wed, 26 Feb 2020 09:44:00 -0800

The real stinker this month, KB 4524244, rolled out the automatic update chute for four full days until Microsoft yanked it – leaving a trail of wounded PCs, primarily HP machines, in its wake. The other big-time bug in this month’s patches, a race condition in the KB 4532693 Win10 version 1903 and 1909 cumulative update installer, hasn’t been officially acknowledged by Microsoft outside of a blog post. But at least it’s well known and understood.

Folks running SQL Server and Exchange Server networks need to get patched right away.

Win10 UEFI update KB 4524244 blockages

Patch Tuesday brought KB 4524244 for Windows 10 owners, a bizarre single-purpose patch apparently directed at one specific UEFI bootloader. I talked about it last week.

To read this article in full, please click here

Independent Krebs

February 26, 2020 admin

Zyxel 0day Affects its Firewall Products, Too

Credit to Author: BrianKrebs| Date: Wed, 26 Feb 2020 14:43:31 +0000

On Monday, networking hardware maker Zyxel released security updates to plug a critical security hole in its network attached storage (NAS) devices that is being actively exploited by crooks who specialize in deploying ransomware. Today, Zyxel acknowledged the same flaw is present in many of its firewall products.