Month: May 2018

PGP Encryption Flaw Discovered in Email Security

Posted on by Rob Burdett

A German newspaper has released details of a security vulnerability, discovered by researchers at Munster University of Applied Sciences, in PGP (Pretty Good Privacy) data encryption.

What Is PGP?

PGP (Pretty Good Privacy) is an encryption program that is used for signing, encrypting, and decrypting texts, e-mails, files, directories, and disk partitions, and to increase the security of e-mail communications. As well as being used to encrypt and decrypt email, PGP is also used to sign messages so that the receiver can verify both the identity of the sender and the integrity of the content. PGP works using a private key that is kept secret, and a public key that the sender and receiver share.

The technology is also known by the name of GPG (Gnu Privacy Guard or GnuPG), and is a compatible GPL-licensed alternative.

PGP, email encryption flaw
PGP encryption flaw found
What’s The Flaw?

The flaw, which was first thought by some security experts to affected the core protocol of PGP (which would make all uses of the encryption method, including file encryption, vulnerable), is now believed to be related to any email programs that don’t check for decryption errors properly before following links in emails that include HTML code i.e. email programs that have been designed without appropriate safeguards.

‘Efail’ Attacks

The flaw leaves this system of encryption open to what have been called ‘efail’ attacks. This involves attackers trying to gain access to encrypted emails (for example by eavesdropping on network traffic), and compromising email accounts, email servers, backup systems or client computers. The idea is to reveal the plaintext of encrypted emails (in the OpenPGP and S/MIME standards).

This type of attack can be carried out by direct exfiltration, where vulnerabilities in Apple Mail, iOS Mail and Mozilla Thunderbird can be abused to directly exfiltrate the plaintext of encrypted emails, or by a CBC/CFB gadget. This is where vulnerabilities in the specification of OpenPGP and S/MIME are abused to exfiltrate the plaintext.

What Could Happen?

The main fear appears to be that the vulnerabilities could be used to decrypt stored, encrypted emails that have been sent in the past (if an attacker can gain access). It is thought that the vulnerabilities could also create a channel for sneaking personal data or commercial data and business secrets off devices as well as for decrypting messages.

What Does This Mean For Your Business?

It is frustrating for businesses to learn that the email programs they may be using, and a method of encryption, supposed to make things more secure, could actually be providin a route for criminals to steal data and secrets.

The advice from those familiar with the details of the flaw is that users of PGP email can disable HTML in their mail programs, thereby keeping them safe from attacks based on this particular vulnerability. Also, users can choose to decrypt emails with PGP decryption tools that are separate from email programs.

More detailed information and advice concerning the flaw can be found here: https://efail.de/#i-have

Globalnet IT Innovations offer a range of managed IT services and on-demand IT services, including secure Outlook 365 email. Call us on 0203 005 9650 to speak to one of our IT consultants and discover how we can help you reach your business goals.

Fewer Shop Visits Due To Digital. But More Spending

Posted on by Rob Burdett

British Retail Consortium (BRC) figures show that footfall in retail stores fell by 3.3% in April 2018 compared to last year, marking a further shift in consumer behaviour towards digital adoption.

Two Consecutive Months

The drop in footfall numbers for April was the second consecutive month where the trend away from visiting the physical high street could be observed, and in comparison to this time last year when footfall was on the up, it is seen by analysts as being significant.

Visiting Even Less – But Still Spending

The last time such a significant drop in footfall occurred (3.8%) was recorded was in 2009 when the UK was in recession and consumers were spending less as a result. Even compared to that, this year’s drop in the numbers of people visiting physical store locations is larger at 4.8%.

Despite the apparent fall in physical store visits, Barclays bank data shows that consumer spending is still on the increase.

What’s Happening?

Retail experts have noted a shift in consumer behaviour towards digital shop visits rather than physical ones, based on a number of benefits including flexibility (in what goods they purchase and when), product / service ranges available, convenience, digital innovations enhancing customer experiences, and a predisposition towards leisure rather than retail spend.

This changing consumer behaviour is forcing the retail industry to evolve and re-structure.

Increased Leisure Spending

One key trend that has been noted by analysts is the increase in leisure rather than retail spending by consumers. For example, a report by Deloitte based on the quarterly survey of more than 3,000 UK adults found that 2017 (last quarter) ended positively for the leisure sector, with consumer spending increasing in 7 out of 11 leisure categories compared to the previous year.

The areas that have shown an increase include experience-led activities, short break holidays, going to the gym, drinking in pubs and bars and attending live sporting events.

What Does This Mean For Your Business?

For retail businesses, these figures mean that the digital retail environment is posing many challenges, but the changes can also be embraced as part of a restructured strategy to remain competitive.

Many retailers understand that they now need to rebalance investment in physical and digital infrastructure, and change the way stores are used e.g. by adopting technology to engage people, and to make stores more like centres for experiences rather than just places for purchasing goods. This is particularly important for younger consumer groups.

Retailers can embrace technology as an opportunity to deliver more value to customers whether in store, at home or on the move. Retail commentators frequently talk about the importance of the need to create a seamless customer experience between online and offline, and to develop an omni-channel platform. Improving and optimising the current experience that retailers offer customers, and replicating these as effectively as possible across all channels could be the key to staying competitive in the evolving retail business environment.

Handy Location Tracker

Posted on by Rob Burdett

A peanut-shaped, hand-held, smart, long-range tracking device called LynQ has been launched that can tell you how far and in what direction your friends are, all without the need for a data connection, and without monthly fees.

Why?

As well as being used for outdoor activities to replace traditional maps and location methods, a ‘LynQ’ can be used as a safety device for tracking children or pets, for rescue workers, or for making sure dementia sufferers don’t wander too far. It can also be used as a fun / leisure device e.g. to find each other in festival crowds, or to keep track of each other when hiking or skiing.

How Does It Work?

Powered by a rechargeable power cell that can offer up to three days of battery life between charges, a LynQ can reportedly track other LynQ users from up to 3 miles (5km) away.

Being marketed as a kind of smart compass for the 21st century, the LynQ doesn’t need an app, phone or Wi-Fi network. Instead, it uses what is described as “a new approach to GPS”. This means that LynQ devices send their GPS coordinates directly to each other. The GPS data has a compression algorithm applied to it in order to make it possible to send that data more frequently and reliably.

2 To 12 People Can Use

LynQ allows 2 or more people (up to 12 can link up) to use a one-button control and simple digital interface to find each other. The display shows a simple display of distance and direction that changes accurately as you move towards or away from your target, and the single button allows you to switch between people you’re tracking.

The display turns off automatically when you let it go to hang by its clip, thus saving battery life, but the LynQ is always receiving the data.

Other Features

The device allows you to create a “home” location that linked devices can point toward. It also allows you to set a safe zone (a radius from your device) that will warn you if the other person leaves that safe zone. You can also send basic preset messages like “meet up” or “help.”

The price is $154 / £114.30 per pair (early bird), going up to $200 / £148.40.

What Does This Mean For Your Business?

This is another smart device that shows how a combination of technologies can be used to create something that can meet a real need and has multiple applications e.g. leisure, sport, safety, and even defence. For example, the Thai Ministry of Defence tested LynQ and found that it helped soldiers find each other much faster while radio silent, and helped them quickly get into formation for a search mission.

This could also represent another possible way to keep track of those in the care of others e.g. dementia sufferers being tracked by carers. Back in 2016 for example, a barcode tagging system for tracking elderly dementia sufferers was being tested in Tokyo, but the LynQ could provide an even simpler and more practical system.

Quite simply as a gadget, the LynQ appears to have multiple applications, thereby offering many opportunities to business and personal users. The fact that the LynQ requires no monthly fees, and doesn’t require a data connection will increase its appeal.

The hope is that the LynQ device is secure and that signals can’t be intercepted and used by criminals to track victims e.g. for attack or abduction. There are still widespread fears about the vulnerability of many smart / IoT devices to hacking, but the fact that LynQ doesn’t need a connection could make it safer.

Tech Tip – Play Almost Any File Format

Posted on by Rob Burdett

If you sometimes have trouble opening and playing certain file formats e.g. for videos, free and open-sourced VLC software makes it easy to play almost any file format you throw at it.

To download the app, which works with Mac, PC, Linux, Android, and iOS, and states that it doesn’t deliver ads or engage in user tracking:

– Go to https://www.videolan.org/vlc/features.html

– Click on the appropriate Operating System.

– Read the details and click on the orange download button.

Twitter Says Change Your Password

Posted on by Rob Burdett

Twitter has advised all users to change their passwords after a bug caused the passwords to be stored in easily readable, plain text on an internal computer log.

The Bug – Passwords Visible Before ‘Hashing’

Twitter reported on their own blog that the bug that stored passwords had been ‘unmasked’ in an internal log. The bug is reported to have written the passwords into that internal log before Twitter’s hashing process had been completed.

The hashing process disguises Twitter passwords, making them very difficult to read. Hashing uses the ‘bcrypt’ function which replaces actual passwords with a random set of numbers and letters. It is this set of replaced characters that should be stored in Twitter’s system, as these allow the systems to validate account credentials without revealing customer password.

Millions Affected?

The fact that the passwords were revealed on an internal server, albeit for what is estimated to be for several months, and that there appears to be no evidence of anyone outside the company seeing the passwords, and no evidence of a theft or passwords turning up for sale on hacker site, indicates that it is unlikely that many of the 330 million Twitter users have anything real to fear from the breach.

Big Breaches

In this case, Twitter appears to have behaved responsibly and acted quickly by reporting the bug to regulators, fixing the bug, and quickly and publicly advising all customers to change their passwords.

Twitter’s behaviour appears to be in stark contrast to the way other companies have handled big breaches. For example, back in November 2017 Uber was reported to have concealed a massive data breach from a hack involving the data of 57 million customers and drivers, and then paid the hackers $100,000 to delete the data and to keep quiet about it.

Breaches can happen for all kinds of reasons, and while Twitter’s breach was very much caused and fixed by Twitter internally, others have been less lucky. For example, an outsourcing provider of the Red Cross Blood Service in Australia accidentally published the Service’s entire database to a public web server, thereby resulting in Australia’s largest ever data breach.

What Does This Mean For Your Business?

If you have a Twitter account, personal or business, the advice from Twitter is quite simply to change your password, and change it on any other service where you may have used the same password. Twitter is also advising customers to make the new password a strong one that isn’t reused on other websites, and to enable two-factor authentication. You may also want to use a password manager to make sure you’re using strong, unique passwords everywhere.

In this case, Twitter has acted quickly, appropriately and transparently, thereby minimising risks to customers and risks to its own brand reputation. Twitter will want this message of responsibility to be received loud and clear, particularly at a time where GDPR (and its hefty fines) is just around the corner, and a time when other competing social networks i.e. Facebook have damaged customer trust by acting less responsibly with their data through the Cambridge Analytica scandal.

8 More Security Flaws Found In Processors

Posted on by Rob Burdett

Following on from the revelation in January that 2 major security flaws are present in nearly all modern processors, security researchers have now found 8 more potentially serious flaws.

Eight?

According to reports by German tech news magazine c’t, the 8 new security flaws in chips / processors were discovered by several different security teams. The magazine is reported to have been given the full technical details of the vulnerabilities by researchers and has been able to verify them.

The new ‘family’ of bugs have been dubbed Spectre Next Generation (Spectre NB), after the original Spectre bug that was made public along with the ‘Meltdown’ bug at the beginning of the year.

90 Days To Respond

The researchers who discovered the bugs have followed bug disclosure protocols, and have given chip-makers and others 90 days to respond and to prepare patches before they release details of the bugs. The 90 day time limit ran out on Monday 7th May.

Co-ordinated Disclosure

Intel is reported to have been reluctant to simply acknowledge the existence of the bugs, preferring to have what it calls a ‘co-ordinated disclosure’, presumably near the end of the protocol time limit, when there has been time to prepare patches and to mitigate any other issues.

It is not yet clear if AMD processors are also potentially vulnerable to the Spectre-NG problems.

How Serious Are The Flaws?

There have been no reports, as yet, of any of the 8 newly-discovered flaws being used by cyber-criminals to attack firms and extract data. According to the magazine C’t, however, Intel had classified half of the flaws as “high risk”, and the others as “medium risk”.

It is believed that one of the more serious flaws could provide a way for attackers access a vulnerable virtual computer, and thereby reach the server behind it, or reach other software programs running on that machine. It has been reported that Cloud services like Amazon’s AWS may be at risk from this flaw.

Meltdown and Spectre

The original Meltdown and Spectre flaws were found to have been present in nearly all modern processors / microchips, meaning that most computerised devices are potentially vulnerable to attack, including all iPhones, iPads and Macs.

Meltdown was found to leave passwords and personal data vulnerable to attacks, and could be applied to different cloud service providers as well as individual devices. It is believed that Meltdown could affect every processor since 1995, except for Intel Itanium and Intel Atom before 2013.

Spectre, which was found to affect Intel, AMD and ARM (mainly Cortex-A) processors, allows applications to be fooled into leaking confidential information. Spectre affects almost all systems including desktops, laptops, cloud servers, and smartphones.

What Does This Mean For Your Business?

The discovery of a family of 8 more flaws on top of the original 2 ‘Spectre’ and ‘Meltdown’ flaws is more bad news for businesses, particularly when they are trying to make things as secure as possible for the introduction of GDPR. Sadly, it is very likely that your devices are affected by the several or all of the flaws because they are hardware flaws at architectural level, more or less across the board for all devices that use processors. The best advice now is to install all available patches and make sure that you are receiving updates for all your systems, software and devices.

Although closing hardware flaws using software patches and updates is a big job for manufacturers and software companies, it is the only realistic and quick answer at this stage to a large-scale problem that has present for a long time, but has only recently been discovered.

Regular patching is a good basic security habit to get into anyway. Research from summer 2017 (Fortinet Global Threat Landscape Report) shows that 9 out of 10 impacted businesses are being hacked through un-patched vulnerabilities, and that many of these vulnerabilities are 3 or more years old, and there are already patches available for them.

Facebook Loyalty Intact Says Survey

Posted on by Rob Burdett

Even after all the publicity surrounding Facebook’s selling of the personal data of 87 million users to Cambridge Analytica, a Reuters/Ipsos survey has found that most users are still loyal to the social media giant.

Just A Public Relations Problem

The survey conducted April 26-30 was based in the US, the home country of Facebook and the place where the vast majority of those whose data was sold live. Far from indicating that any users have been outraged by the selling of their personal data property without their permission, the survey appears to show that Facebook has so far suffered no ill effects from the scandal, other than a public relations headache.

A Quarter Using Facebook More!

The survey showed that half of US Facebook users said they had not recently changed the amount that they used the site, and, incredibly, a quarter of those surveyed said they were using it more!

The remaining 25% said that they were using it less recently, had stopped using it, or deleted their account.

64% of those surveyed said they still used Facebook at least once a day, down only slightly from the 68% recorded in a similar poll in late March.

The results appear to show, therefore, that the numbers of those using Facebook more has balanced out the numbers of any respondents who said they used the platform less, meaning that, according to the survey, Facebook appears to have suffered no real damage other than a PR hit from the scandal.

Wait Until 2nd Quarter

Facebook actually showed a near 50% increase its sales in the first quarter of this year, with profits up to $4.9bn from $3bn last year. Some commentators have stressed, however, that any of the financial effects of the scandal are likely to be evident in the second quarter.

Cambridge Analytica Closed

While Facebook, a social media giant, appears to have suffered no real damage other than a PR hit, Cambridge Analytica has been forced to go into liquidation blaming negative media attention. Some commentators have pointed out that Cambridge Analytica portrayed themselves as victims of unwarranted press activity, thereby deflecting blame from their activities involving the use of the personal data of millions to influence election and referendum outcomes.

Trusted With Dating Information?

It may appear that customer loyalty is still intact to a large extent now, but the next test for Facebook could be whether customers will trust them with their privacy when Facebook rolls out its dating service app later this year.

What Does This Mean For Your Business?

This story shows what many tech commentators had predicted – that the fact that Facebook was so much a part of peoples’ daily routine with no real alternative among the other social media platforms, that it could weather the storm and come out the other end with little real impact on its user numbers. It seems strange that, even though customers personal details were harvested and sold to a third party, without the permission of users, and then used to potentially influence how they voted in the US election (and in the Brexit referendum in the UK) that very few people appear to be prepared to see that as grounds to reject Facebook and the service and value that it offers in their lives.

People actively use Facebook as an integral part of their friendship networks and as a source of news, thereby allowing it unprecedented access to their personal lives and interests, as well as allowing it to help shape their view of the world, and it may be this investment and yes, loyalty, that has allowed them to apparently forgive Facebook for its part in the scandal, and to allow the value that Facebook offers in their lives to outweigh Facebook’s indiscretions.

From a business point of view, this shows how powerful loyalty can be, especially if a service can offer value that links strongly to ‘self’ and things that have emotional and personal connections and importance, and allow and enable real engagement.

Cambridge Analytica Ordered To Turn Over All Data On US Professor

Posted on by Rob Burdett

The UK data watchdog, the Information Commissioner’s Office (ICO), has ordered the consulting firm Cambridge Analytica to hand over all the personal information it has on US citizen Professor David Carroll, or face prosecution.

Demand Made in May 2017

The consulting firm, which is reported to have ceased operations and filed for bankruptcy in the wake of the recent scandal involving its access to and use of Facebook users’ details is facing the Enforcement Notice and possible legal action (if it doesn’t comply) because it has not fully met a demand made by Professor Carroll early last year.

Who Is Professor David Carroll?

David Carroll is a professor at the New School’s Parsons School of Design. Although Professor Carroll is based in New York and is not a UK citizen, he used a subject access request (part of British data protection law) to ask Cambridge Analytica’s branch in the UK to provide all the data it had gathered on him. With this type of request, organisations need to respond within 40 days with a copy of the data, the source of the data, and if the organisation will be giving the data to others.

It has been reported that Professor Carroll, a Democrat, was interested from an academic perspective, in the practice of political ad targeting in elections. Professor Carroll alleges that he was also concerned that he may have been targeted with messages that criticised Secretary Hillary Clinton with falsified or exaggerated information that may have negatively affected his sentiment about her candidacy.

Sent A Spreadsheet

Some weeks after Professor Carroll filed the subject access request in early 2017, Cambridge Analytica sent him a spreadsheet of information it had about him.

It has been reported that Cambridge Analytica had accurately predicted his views on some issues, and had scored Carroll a nine 9 of 10 on what it called a “traditional social and moral values importance rank.”

What’s The Problem?

Even though Carroll was given a spreadsheet with some information, he wanted to know what that ranking meant and what it was based on, and where the data about him came from. Cambridge Analytica CEO Alexander Nix told a UK parliamentary committee that his company would not provide American citizens, like David Carroll, all the data it holds on them, or tell them where the data came from, and Nix said that there was no legislation in the US that allowed individuals to make such a request.

The UK’s Information Commissioner, Elizabeth Denham, sent a letter to Cambridge Analytica asking where the data on Professor Carroll came from, and what had been done with it. Elizabeth Denham is also reported to have said that, whether or not the people behind Cambridge Analytica decide to fold their operation, a continued refusal to engage with the ICO will still potentially breach an Enforcement Notice, and it will then become a criminal matter.

What Does This Mean For Your Business?

Many people have been shocked and angered by the recent scandal involving Facebook and its sharing of Facebook user data with Cambridge Analytica. The action by Professor Carroll could not only shed light on how millions of American voters were targeted online in the run-up to the 2016 election, but it could also lead to a wider understanding of what data is stored about us and how it is used by companies and organisations.

The right to request personal data that an organisation holds about us is a cornerstone right in data protection law, and this right will be brought into even sharper focus by the introduction of GDPR this month. GDPR will also give EU citizens the ‘right to be forgotten’, and has already put pressure on UK companies to put their data house in order, and prepare to comply or face stiff penalties.

This story also shows that American citizens can request information from companies that process their data in the UK.

Google Driverless Car Involved In Smash

Posted on by Rob Burdett

A self-driving vehicle owned by Google’s Waymo has been involved in a smash in Arizona when it was hit by a car that swerved across multiple lanes.

Driverless Mode – But With Person On Board

The Google car was in autonomous / driverless mode at the time of the crash, but had a test driver in the driver’s seat. The lady occupant is reported to be recovering from the incident.

A discussion is now underway as to whether the driverless car system or the test driver on board could have done anything more to avoid being hit by the other vehicle.

Waymo and Jaguar

Waymo is the self-driving car company that is owned by Google’s parent company Alphabet, and has been testing driverless vehicles since 2009. It has been reported that Waymo wants to purchase 20,000 Jaguar electric vehicles as part of its plans to launch a robotic ride-hailing service in the US.

It is understood that Waymo’s link-up with Jaguar will mean that from 2020 to 2022, UK-based (owned by India’s Tata Motors ) Jaguar Land Rover (JLR) I-PACE electric cars will be providing up to one million rides per day in the service. It is thought that Jaguar cars will appeal to more upmarket customers, thereby already showing the possibilities for segmentation in driverless ride-hailing services.

The ride-hailing service will be launched on a small scale in Phoenix, Arizona, first in the coming months.

Not The First Autonomous Vehicle Accident

Although the Google car did not cause the crash, this is not the first time an autonomous vehicle has been involved in a serious incident. Back in March, Uber suspended all self-driving car tests in all North American cities after a fatal accident a 49-year-old woman was hit and killed by one of its autonomous vehicles as she crossed the street in Tempe, Arizona.

This was the second time that Uber has pulled its self-driving cars from the roads after an accident. A year earlier, also on Arizona, an Uber Volvo SUV in self-driving mode ended up on its side after another vehicle “failed to yield” to the Uber car at a left turn.

Autonomous Lorry Convoys on UK Roads This Year

Last year, the UK government announced that ‘platoons’ (mini-convoys) of self-driving, partially autonomous lorries are to be tested on British roads before the end of 2018. The so-called ‘platoons’ will take the form of several lorries driving closely together in a line in the inside lane, with the lead lorry wirelessly controlling the acceleration and braking for all the lorries, and with the following lorries responding to the changes in speed.

It is understood that for the tests which have been promised since 2014 and will be carried out by the Transport Research Laboratory (TRL), a human driver will be in the cab of the lead lorry, and will be able to take control if things don’t go entirely to plan.

What Does This Mean For Your Business?

Autonomous vehicles and vehicles with autonomous elements are already being tested and used in commercial environments and as part of the transport system in the US and the UK. The combination of driverless vehicles powered by electricity and using AI technology could provide a more environmentally-friendly solution to a variety of different transportation and delivery challenges, and to hopefully reduce traffic accidents.

The accidents involving driverless vehicles to date have, however, prompted some commentators to warn that the technology is being deployed before it is ready. Clearly, it is still early days for autonomous vehicles which means that there are still many untapped opportunities to use autonomous vehicles commercially, and there are of course many challenges and issues to consider around safety, insurance, regulations and reliability.

Autonomous vehicles are likely to be adopted more quickly on closed sites first, but operators who decide to adapt such sites to work for autonomy could expect significant improvements in productivity and safety.

Despite any bad press from the unfortunate crashes involving test autonomous cars in the US, having an emerging industry such as autonomous vehicles, with all its talent, technology and development centres here in the UK represents a huge opportunity for UK businesses as potential suppliers, beneficiaries of the technologies and products, and spin-off market opportunities. It also represents an opportunity for UK insurers.

Whereas the UK has a skills gap in many areas of the technology market, with the right amount of support and backing from the government and other investors, the testing, developing, and production of autonomous vehicles and the necessary technologies could be one area where home-grown talent is tempted to stay in what could become a world-centre of excellence for autonomous vehicle / AI technology.

Tech Tip – Get More Value From Your Gmail Account

Posted on by Rob Burdett

If, like many people, you have a Gmail account that you regularly use and you want to improve the value you get from your Gmail setup, try features such as ‘Canned Responses’ and ‘Gmail Offline’ (ahead of Google’s planned updates).

If you frequently have to send out the same email message each time to multiple persons, your ‘Canned Responses’ feature lets you prepare a stock message that you can send out when you need it, thereby saving time. To operate ‘Canned Responses’ in your Gmail account:

– When logged in, go to ‘Settings’.

– Select ‘Labs’.

– Look for ‘Canned Responses’ and click on ‘Enable’.

– Type out your stock message and send it when required.

The Gmail Offline feature allows you to read, write and send messages when you’re out of touch, and when you log back in, all your activity will is pushed through Google’s system. Here’s how to set it up:

– When logged in, go to ‘Settings’.

– Select ‘Offline’.

– Click on ‘Install Gmail Offline’.