Bot-Driven Credential Stuffing Hits New Heights

Found on Info Security on Friday, 23 February 2018
Browse Internet

More than 40% of global log-in attempts are malicious thanks to bot-driven credential stuffing attacks, according to the latest report from Akamai.

The stats chime with similar data from fraud prevention specialist ThreatMetrix, which claimed in its latest Cybercrime report for Q4 2017 that there were 34 million bot attacks during the peak festive shopping period, rising to 800 million for the quarter.

You could say more than 90% and still be correct.

AMP for email is a terrible idea

Found on Techcrunch on Thursday, 15 February 2018
Browse Internet

Google just announced a plan to “modernize” email with its Accelerated Mobile Pages platform, allowing “engaging, interactive, and actionable email experiences.”

“AMP started as an effort to help publishers, but as its capabilities have expanded over time, it’s now one of the best ways to build rich webpages,” it writes in the blog post announcing the AMP for Gmail test.

What a great new attack vector for spreading malware. If the email won't be readable in plaintext view with remote content blocked, then it will go straight to the trash. No questions asked.

Consumers prefer security over convenience for the first time ever, IBM Security report finds

Found on Tech Republic on Tuesday, 13 February 2018
Browse Internet

"We always talk about the ease of use, and not impacting user experience, etc, but it turns out that when it comes to their financial accounts...people actually would go the extra mile and will use extra security," Kessem said.

"They understand that there's something they can do to prevent it, and they need to secure their accounts," she said.

It took them long enough to finally realize that security does play a very important role; and not only when it comes to financial services, but in general.

Don't use Facebook's Messenger Kids, advocates say

Found on Cnet News on Tuesday, 30 January 2018
Browse Internet

A group of child advocates is sounding an alarm about Messenger Kids, saying young people should be shielded from these types of services until they're older.

Facebook says it designed Messenger Kids to help parents and children chat in a safe way and give parents control of their kids' contacts and interactions.

Children should use all online services with great care. It's much better for them to develop their social abilities by face-to-face contacts in real life first, despite what millenials might think.

Millennials Likely to Use Biometrics for Authentication, IBM Finds

Found on eWEEK on Monday, 29 January 2018
Browse Internet

The study also revealed user attitudes about biometric authentication technologies. 44 percent or respondents identified fingerprint biometrics as the most secure method of authentication. In contrast, only 27 percent rated passwords as being the most secure from of authentication.

"The study results show that millennials place higher value on convenience and memorizing dozens of new, complex, unique passwords is cumbersome, especially as these users are likely to have a growing number of accounts that require such passwords."

Changing your password is easy; changing your fingerprint is not. Also, you should think twice about using biometrics: fingerprints are unique so there is a risk of group all your various online accounts together. Not to mention that for those who control important and secret information this will never be an option because counter-intelligence just needs to beat you senseless and then put your finger onto the scanner.

New York investigates company accused of selling fake Twitter followers

Found on BBC News on Sunday, 28 January 2018
Browse Internet

It is alleged that others who wanted to increase their follower count, including actors, entrepreneurs and political commentators, could then pay to be followed by the bots.

On social media, high follower accounts boost influence, which can impact public opinion, or bring advantages, such as job offers or sponsorship deals, to account holders.

"Devumi has helped over 200,000 businesses, celebrities, musicians, YouTubers and other pros gain more exposure and make a big impact to their audience," says its website.

Sad to see that so many people care about followers. Maybe they should better see a headshrink.

Vulnerable industrial controls directly connected to Internet? Why not?

Found on Ars Technica on Friday, 26 January 2018
Browse Internet

You might not think that factory industrial controls would be directly accessible from the Internet. But a quick survey of devices open on the network port mentioned in the advisory (TCP port 102) using the Shodan search engine revealed over 1,000 Siemens devices directly accessible on the Internet (plus a certain number of honeypots set up to detect attacks).

Ironically, the credential-stealing vulnerability may not even be an issue in some cases, because a substantial number of the devices surveyed in the Shodan search had no authentication configured at all.

Sounds like it's about time for "Brickerbot, the enterprise version".

Google to Use Page Speed as Ranking Factor for Mobile Search

Found on eWEEK on Thursday, 18 January 2018
Browse Internet

Generally, websites with fast loading pages will get a higher ranking in search results than those of the same quality content but with slower page speeds. Google will apply the speed-ranking factor to all mobile pages regardless of the technology used to build the page.

More recently, the company began rolling out mobile-first indexing under which it has begun using the mobile version of a website's content first when indexing pages for search. Prior to the shift, Google's search engine crawlers looked at the desktop content first for site indexing.

Google needs to treat all versions of a website equally; websites need to load fast on mobile and desktop devices. That should make webmasters think before adding tons of external resources; some websites come with several dozens of trackers, and once you turn off Javascript those pages load an order of magnitude faster.

HTML5 may as well stand for Hey, Track Me Longtime 5. Ads can use it to fingerprint netizens

Found on The Register on Wednesday, 17 January 2018
Browse Internet

HTML5 is a boon for unscrupulous web advertising networks, which can use the markup language's features to build up detailed fingerprints of individual netizens without their knowledge or consent.

But what’s needed is a fundamental rethink, with features that ensure tracking-free browsing, just as private browsing doesn’t record session data on a local workstation. Some kind of warning, similar to the HTTPS icon, would also be useful.

Leaving tracking unpatched will end up as a risk for every Internet user.

Facebook Now Prioritizing Friends' Posts Over News Items

Found on eWEEK on Friday, 12 January 2018
Browse Internet

The social network will use its analytics to publish on an automated basis what it assumes its users would rather see; for example, a post about a friend’s trip to Italy will get preferential treatment over, say, a coupon from The Gap or a Wall Street Journal news item about a change in U.S. immigration policy.

Thus, the social network is now more heavily pre-editing the information it presents to you. It has done this previously but ranked news items from businesses, brands and media outlets in a more evenly distributed fashion with items from friends and family members.

Yes, your little social bubble just got even smaller.