Inside | Real news, curated by real humans
Inside Security

Inside Security (Apr 21st, 2017)

David’s Take: spousal spyware

I am not proud of the fact that one of the reasons why my first marriage ended was due to some information that I collected from my ex using network monitoring tools. While that was a long time ago, now suspicious spouses have tools that are easier to use than my packet sniffer, such as PhoneSheriff. In an ironic twist, the vendor of this spyware has had its customer data leaked. These account holders include a fifth grade teacher at a school in Washington, DC; a man who breeds dogs professionally in Georgia; and the president of a sunglasses distributor in New York. There are also numerous victims of domestic violence who were monitored as well. This spyware is intrusive: you can intercept calls; remotely switch on the device's microphone; monitor Facebook, WhatsApp, and iMessage chats; read text messages; track the phone's GPS location, and record the user's Internet browsing history. Motherboard did some research into these tools.

-- David Strom, editor of Inside Security

NB: I will be on vacation next week, but have written two special issues of Inside Security that are scheduled to arrive on Tuesday and Thursday. Will be back with the regular edition on Monday May 1.

  • Email gray
  • Permalink gray

Threat of the week: IHG widens data leak estimate

There has been a wider breach at Intercontinental Hotels Group than was initially acknowledged by the company earlier this year.  It’s the second breach that IHG, a multinational hotel conglomerate that counts Holiday Inn and Crowne Plaza among its chains, has disclosed this year. The company acknowledged in February that a credit card breach affected just 12 of its hotels and restaurants. This turned out to be wishful thinking. IHG has a poorly-designed search form for customers to find out if a hotel they stayed at was compromised. Brian Krebs reports “IHG also has been trying to steer franchised properties toward adopting its secure payment solution that ensures cardholder data remains encrypted at all times.” Properties that used its solution prior to the initial intrusion on Sept. 29, 2016 were not affected.

  • Email gray
  • Permalink gray

Reports

Nearly half of UK firms experienced a breach or cyber-attack last year, with many still failing to implement basic, formalized security despite spending money on threat defense, according to a new government report. The Cyber Security Breaches Survey 2017 is based on interviews with over 1,500 businesses. One source interviewed for the story said that the other “half of those that were surveyed and responded with the belief they were not hacked simply are not aware” of any breach. – INFOSECURITY MAGAZINE (UK)

  • Email gray
  • Permalink gray

The new system that Microsoft is using to deliver patch information is confounding IT managers who were used to the old ways of Redmond. In a report here, readers say things like “this is one additional complication that I simply didn't need.” Another one commented: It “sounds like a half-finished good idea.”  -- ARS

  • Email gray
  • Permalink gray

Self-promotions dep’t

The Imperva CISO Shahar Ben-Hador sat down to record a webcast on how not to get fired as the CISO, and how to create a longer-term job strategy. This links to a summary post of the webinar, with such bon mots as “A successful CISO needs to be both strategic—long-term plan, collaborate with teams, communicate to executive management and the board—and tactical. He also needs to embrace innovation.” – IMPERVA BLOG

  • Email gray
  • Permalink gray

Funding announcement

Dome9 Security this week announced the close of $16.5M in Series C funding led by SoftBank Corp. The cloud infrastructure security vendor is based in Israel and Silicon Valley. Zohar Alon is their CEO.

  • Email gray
  • Permalink gray

Methods and tools

Given the recent history of various DNS attacks, you might be interested in doing a DNS audit of your infrastructure. We tend to forget about its configuration once it is setup. Here are five essential steps to conducting a successful DNS audit, such as tuning your negative caches of Time to Live parameters, building in DNS failover protection and understanding how your network operates across different domain names.   -- DARK READING  (Warning: annoying slideshow ahead)

  • Email gray
  • Permalink gray

Microsoft has updated up its Authenticator smartphone app by adding another authentication factor: your phone number. The free app is similar to ones from Google and others by referencing a one-time password that you use as part of the login process. I tried to add this feature to my app but wasn’t successful. -- TRIPWIRE

  • Email gray
  • Permalink gray

Just for Fun

Jannis Hermanns built his own replica of a classic Mac out of Lego bricks based on a Raspberry Pi with an eInk display. He had to custom design the case and do some work to connect everything up and you can see the results here. -- ARS

  • Email gray
  • Permalink gray

How likely are you to recommend Inside Security to a friend or colleague?

          

Subscribe to Inside Security