Naked Security Posts

News in brief: Hollywood fights piracy; Covfefe not a typo; Kim Dotcom loses Your daily round-up of some of the other stories in the news!   Blast from the past – Patch Tuesday updates for Windows XP Dust off your company procedures for Patch Tuesday! XP gets a raft of official updates this month to fix publicly-known holes.   Infection by mouseover – what you need to know about PowerPoint spam Malware-laced PowerPoint files are nothing new - but several recent spam campaigns have added a new twist.

Naked Security: Google joins the efforts to halt the spread of fake news

• By Alison Booth, nakedsecurity.sophos.com
• View Original
• April 13th, 2017

Earlier this week, Google rolled out a new tool to help users around the globe differentiate between real and fake news. Tested on news stories in a handful of countries over recent months, the “Fact Check” tag adds additional information to some of the technology giant’s search and news results. As a Google blog post explains:

This label identifies articles that include information fact checked by news publishers and fact-checking organizations… so people can make more informed judgments

The snippet that’s added reveals the claim and who made it, along with the name of the organization that checked it and what they concluded.

Read on…

Google boosts verification after wave of Maps fake listings fraud

Apparently Google has been having some issues with illegitimate companies populating their maps, some even with ratings. They are getting there through the free to list Google My Business program.

In the Naked  Security Article, John E. Dunn goes into depth about how Google is admitting that it has been working on this problem for awhile.

This is not just a problem with Google’s search engine but other like Bing. So be aware that this is going on and gird yourself against these fraudsters!

Read the entire article here.

Naked Security: AKBuilder, Microsoft Word Intruder exploiting Office RTF vulnerability

A Microsoft bulletin for patching Office released last October patches a vulnerability attackers could exploit on your computers. Read here what this exploit is all about and what you need to do to protect yourself before you become infected.

SophosLabs researchers have discovered fresh cases of AKBuilder and Microsoft Word Intruder (MWI) exploiting the flaw.

This vulnerability is already under fire by two major exploit builders. It all happened within a couple of weeks, with the help of an underground forum.

Naked Security: Fallen for a fake Twitter Account? Here’s how to spot them

By Lisa Vaas, nakedsecurity.sophos.com       February 14th, 2017

On Tuesday, a fake Twitter account purportedly belonging to the retired Lieutenant General Michael Flynn, who had resigned from his position as US national security adviser the night before, hoodwinked not only the New York Times and other media outlets, but also House Minority Leader Nancy Pelosi and Congressman Elijah Cummings.

See the rest of the article here…

How to spot a fake Twitter account

Is it verified?

In a FAQ on its verified accounts, Twitter says that, typically, verified accounts belong to users in music, acting, fashion, government, politics, religion, journalism, media, sports, business and more, be they brands or individuals.

How much does Facebook really know about you – and is it right?

This is a very interesting point of view on how Facebook and other social networks use your interactions with their applications to their financial benefit. These “Free” services aren’t really free. They may be costing you in ways other than monetarily. Take a quick peak.

It is always a good thing to be more fully aware of what you are getting into when you access an online service. Be careful of the information you share and equipment you use to to access it.

Google Play causing issues with battery life?

How Google Play tracks you even if your other apps don’t – Naked Security

Naked Security posted an article that Google Play’s update that is tracking your usage or their service by using GPS which if you didn’t know when turned on and in use can drain your battery very quickly. For more detail on this read the article by clicking on the link above.

How not to use Facebook

I don’t understand the need for people to put every part of their personal life on-line for everyone to see. But what is even worse is for someone to respect another’s request for not posting what are embarrassing photos of their child that makes them uncomfortable. Once that child makes their request known, if the parent truly cares for them they really should be considerate of their request. That’s when I saw this article in nakedsecurity.sophos.com, it really made me angry with the parents.

And the worst passwords from the Last.fm hack are… – Naked Security

Interesting historical cloud product shows how lazy we really are about creating our passwords. If you use any of these password today, SHAME ON YOU!

Take a quick look at this article, I think you will find it very interesting.

iOS World–Important security patch now available

I was ignoring the update until I read this article in Naked Security. (If you have an iDevice, go to Settings | General | Software Update right now, just to make sure you’re up-to-date.)

Apparently there are three exploits that were being used to hack into your device. So it was good the Apple came out with the patch so quickly and don’t forget to install this security patch soon!

Are you Click Happy?

Naked Security posting points out that a large number of Facebook users are not real careful about how they use Facebook. Because of the actual structure of being able to post links on your Facebook postings, these links can direct you towards anything with out knowing where you are actually going to end up or how that destination will affect your device.

Part of keeping your equipment secure and safe is to be aware of what you are doing and where you accept to go. Look at who is posting and where that posting is taking you. If you don’t know then maybe you shouldn’t necessarily be in such a hurry to find out. And don’t forget that you can put Sophos on your home and mobile devices for free.

Naked Security Post: NIST’s new password rules – what you need to know

by Chester Wisniewski

It’s no secret. We’re really bad at passwords. Nevertheless, they aren’t going away any time soon.

With so many websites and online applications requiring us to create accounts and think up passwords in a hurry, it’s no wonder so many of us struggle to follow the advice of so-called password security experts.

At the same time, the computing power available for password cracking just gets bigger and bigger.

OK, so I started with the bad news, but this cloud does have a silver lining.

It doesn’t need to be as hard as we make it and the government is here to help.

That’s right, the United States National Institute for Standards and Technology (NIST) is formulating new guidelines for password policies to be used in the whole of the US government (the public sector).

Why is this important? Because the policies are sensible and a great template for all of us to use within our own organizations and application development programs.

Anyone interested in the draft specification for Special Publication 800-63-3: Digital Authentication Guidelines can review it as it evolves over on Github or in a more accessible form on NIST’s website.

For a more human approach, security researcher Jim Fenton did a presentation earlier this month at the PasswordsCon event in Las Vegas that sums up the changes nicely.

To see what is new click here

Google adds robocall warnings to Phone app – Naked Security

I sure you have seen an increase in unwanted solicitation call on your mobile phones like I have. Some are spam call any others are outright con artists trying to con you our or your hard-earned money. This article discusses how the FCC is requesting help from our phone carriers and Google’s plans on helping you to determine which calls should be blocked and their suggested method of letting you know and control these unwanted calls.

So, if you are interested click here to read more…

Yahoo ordered to show how it recovered ‘deleted’ emails in drug case – Naked Security

Interesting reading about Yahoo recovering supposedly deleted files from their servers for a U.K. drug case. It makes you wonder what else is available that can be handed over to the government to prosecute you. I am not totally unhappy that these drug dealers information was made available for prosecution, however, this may be a real issue for the general private market out there. Just something to think about!

If this is peak your interest you can read more here.

Have you ever had a cell phone stolen?

CTIA members of the Smartphone Anti-Theft Voluntary Committee have met their voluntary commitment to make antitheft tools available for free on all new mobile phones manufactured after July 2016 for sale in the US. This covers most of the phones that are manufactured for sale in the US.

The first phase of this commitm you ent plan called for the antitheft tools to be installed on all handsets offered for sale after July 2015 in the US. The second phase called for new handset models sold after July 2016 in the US to give authorized users the ability to disable the antitheft tools anytime they want to, as long as the device is still connected and still in the authorized user's possession.

So if you don't like being tracked by your cell phone the ability to turn off this feature is a big boon.

For more information from naked security on the subject click here.

Secure messaging app Telegram leaks anything pasted in to it – Naked Security

While this more of an old story than a new one since a patch for the issue has already been issued, the information that Naked Security discussed was interesting an if you are a Mac user and you are worried about security issues this would be something to consider. Read More Here.

Using a Password Manager to enhance your Security

I spend a lot of time on this site discussing security issues and pointing to articles that describe good methods of securing your personal and work data. I am a big fan of the Naked Security blog not only because it comes from one of most important security partners, Sophos, but also because of the in depth an timely information that they bring to the table. Again, I am going to point you to another article that talks about using LastPass to organize and control the passwords that you use for internet sites. This is a program that most of us internally have been using for a long time to secure our access and we think that using this program to generate better passwords and giving you better control over access to your important websites is extremely important. This along with 2-factor authentication are great steps in securing yourself.

Try a password manager: how to get started with LastPass

Facebook tests end-to-end encrypted Secret Conversations on Messenger – Naked Security

Do you trust Facebook? Their providing end to end encrypted messaging that they don’t keep a record of just seems like something that wouldn’t fly with the government, and aren’t they already in bed with them providing all of the data flowing through their servers?

read Naked Security’s take on this

Ransomware that demands money and gives you back… nothing! – Naked Security

• nakedsecurity.sophos.com
• View Original
• July 13th, 2016

Ransomware isn’t a laughing matter, especially if you’re the victim.

Even if you don’t lose any data in the attack, it’s a bit like getting mugged by crooks who end up running off without your wallet.

If ransomeware by itself wasn’t scary enough!

read more

Users sign away their firstborns on fake social network – Naked Security

We already know that people are willing to hand over their firstborns for free Wi-Fi.

Or, at least, they’re more willing to accidentally sign over perpetual ownership of their tots than they are to read lengthy terms and conditions. We know this thanks to a security firm that set up an open Wi-Fi network in a busy public area in London and then presented people with lengthy terms and conditions to sign up and – buh-bye, now! – inadvertently sign kids away in blissful ignorance.

Now, thanks to new research, we know that the same goes for signing up for a new social media platform.

Sorry, kids: you’ve once again been put on the bargaining table by researchers out to prove the point that this is the biggest lie on the internet:

I have read and agree with the terms and conditions.

The study comes from Jonathan Obar, who teaches communication technology at York University, and Anne Oeldorf-Hirsch, a University of Connecticut communications assistant professor.

read more

https://nakedsecurity.sophos.com/2016/07/15/users-sign-away-their-firstborns-on-fake-social-network/