Password reuse results in missile alert terrifying a family – 01/24/19
A Florida family was terrorized by a notification coming from their Nest security camera alerting them of a missile launch by North Korea. Interestingly enough, until they heard the alert the family didn’t even know the camera had speakers.
Although the traumatized mom blames Nest for not notifying their users of a data breach, it wasn’t Nest who was breached. The data breached occurred elsewhere. As the family reuses passwords, once one of their accounts was exposed it left all of their accounts vulnerable.
Although it certainly would have been a nice bit of customer service for Nest to notify their account holders that they should change their passwords if they reuse them, it is not their legal responsibility as they were not hacked. The responsibility for notification lies with the breached account provider. The family didn’t say whether that notification was received.
Regardless of whether Nest should have notified their users or not, this poor mother still had to watch her terrified nine year old son crawl under the carpet in a panicked attempt to protect himself from nuclear missiles. No mother should have to experience that.
How do you prevent your family from being traumatized by a prankster hacker?
- Be familiar with all the features of your camera before you buy it. Know if it has a microphone or speakers, connects to the internet, whether the default password can be changed, how the firmware is updated and where recorded video is stored.
- Change the default password as soon as you set up the camera. Use a unique, effective passphrase.
- Update the camera’s firmware as soon as it is installed and keep it up to date. If it has an automatic update feature, enable it.
- Disconnect the camera from the internet when you aren’t using it.
Taking these steps will greatly reduce the chances of your camera being hacked. These same steps can be taken to secure any IoT device.
Our world is rapidly changing with technology creeping into all aspects of our lives. It is important that we change with it to ensure our families safety. That means we need to be aware of the risks associated with the devices that we bring into our homes and how to mitigate them. As this Florida family has learned, tech companies aren’t going to do this for us even if we are 114% certain that they should.
Are your credentials part of the latest data breach? – 01/17/19
Troy Hunt, the creator of Have I Been Pwned has just found a massive collection of usernames and passwords sitting on the web. When I say massive, I mean massive. We are talking 1,160,253,228 unique login credentials (usernames and passwords). We have seen large dumps of credentials for sale on the web before. However there has never been a collection of this size.
This alone is concerning, but when you also consider that the information is not sitting hidden in some dusty corner of the dark web, but being openly discussed in various forums the alarms bells start to sound. Add the fact that the information is being given away and not sold and you have reached DEFCON 1. Now any miscreant with time on his hands can start banging away at websites with a free list of easily found credentials. This greatly increases the chance your account(s) will be compromised.
It’s a like finding a garage door opener while out for a walk with your dog. You may not have been planning on breaking into a garage, but when fortune smiles upon you, you take advantage of it and pick up that sucker and start seeing which doors it opens.
The good news is there are things you can do to protect yourself.
- Visit Have I Been Pwned and find out if you are affected.
- Change the passwords on affected accounts as well as any accounts using the same password.
If you aren’t reusing passwords, this is a relatively easy task. If you are then it sucks to be you and it may take you a while. On the up side, you do get to give those brain cells a good workout trying to remember all the accounts that used that password. I lied, that sucks to.
After changing umpteen passwords and straining to remember the names of all your accounts, you may want to stop reusing them and start using a password manager. KeePass is sitting on your workstation and is free to download and use at home. Give Verle Winsor a call to find out how to use it.
If you are ready to invest in a more user friendly tool, you may like Dashlane, 1Password, or LastPass . They all generate effective unique passwords for you and make logging in a breeze on all of your devices.
Hotel chain data breach 11/30/18
Have you stayed at one of the following hotels in the past 4 years?
- W Hotels
- St. Regis
- Sheraton Hotels & Resorts
- Westin Hotels & Resorts
- Element Hotels
- Aloft Hotels
- The Luxury Collection
- Tribute Portfolio
- Le Meridien Hotels & Resorts
- Four Points by Sheraton
- Design Hotels
Lucky you!! There is a possibility your name, mailing address, phone number, email address, passport number, Starwood Preferred Guest account information, date of birth, gender, arrival and departure data, reservation dates and/or credit card information were stolen in a data breach. Marriott has reported an unauthorized access to their guest reservation database was made on or before Sept 10 of this year. However they acknowledge that the criminals have been inside the company’s network since 2014.
In response they have set up a dedicated website, established a call center to answer questions and will be emailing those affected. To make their customers feel better they are also offering a free on year subscription to an internet monitoring service. When a subscriber’s personal information is found on the web, they are notified. This service is available to customers in Canada.
If you think you may have been affected, visit the website for more information and look for signs of identity theft.
Beware the online gift exchange – 11/29/18
The Better Business Bureau is reporting that Facebook and other social media sites are seeing a resurgence of the “Secret Sister” gift exchange. This gift exchange and others like it, promise participants several gifts in exchange for sending one inexpensive gift. All you have to do is give up some personal information and invite your friends to join. If you think this sounds too good to be true, you would be right.
This scam is a classic pyramid scheme which is illegal in both Canada and the US. If you run across one of these gift exchanges on social media, report the post immediately.
Buying tech this Christmas? Check out its creepy factor – 11/20/18
This year, there are tons of cool tech gadgets on the market. Everything from teddy bears that connect to the internet to personal alarms. As neat as all of these devices are, some of them have the potential to leave the users feeling exposed and violated.
Thankfully, the good folks at Mozilla have put together a terrific website that examines the privacy risks of the hottest tech gifts. At privacy not included you can find out what information a device collects, what is done with that data and what kind of security the device has. They also rate customer service. To make it extra fun, consumers can give each item a creepiness rating based on how comfortable they would be having that device in their home. Check it out.
Must Read – The Newsletter is Changing 11/02/18
As part of our efforts to continually improve the newsletter and the information it delivers, we will be returning to the Mailchimp delivery format November 16, 2018. Newsletter articles will continue to reside here, only the delivery format will change.
This will allow us to create newsletters that are more visually appealing and determine what kind of articles people are most interested in. This will be the last newsletter to appear in your inbox as a weekly digest email. For more details, please refer to the email that I sent out to all subscribers.
I hope you enjoy the new format.
Hack the box results – 10/25/18
Today was the final day for the Hack the Box escape room type activity. We had four teams compete in total. In the end we had two faculty teams, one employee team and one student team take up the challenge. HPHED blew away the competition finishing up in just under 20 minutes. HR came in second at 26 minutes, third was the Faculty of Science and Technology and our wonderful students came in last at 30 minutes.
Good fun was had by all. All participants walked away with pens and charging cables from the good folks at Lenovo. Employees also snagged a contest entry code for the Cyber Security Challenge.
Interestingly, HPHED was quite concerned about the leaderboard and their showing on it. They are rather keen to remedy the situation. Facilities management, I would keep an eye on that leaderboard, we may see some changes in the last few days of the Challenge.
Just a reminder that you have until Oct 30 at 4:00 pm to enter in your codes. Tomorrow the last of the newsletter codes will go out. If you have missed previous ones, scroll through the articles on the newsletter website to find them. The Cyberwar Threat, Cyber Safety Survival Guide and the General Security Tips webpage can still be mined for contest entry codes. Check the Cyber Security Challenge webpage for details.
The Cyber Security Challenge Weekly Update – 10/05/18
We have come to the end of the first week of competition. Poor weather and the upcoming holiday has meant a slow start. However we are starting to see entries trickling in. Facilities management is in the lead as Building Operations has been rallying their team. They are working hard on upgrading our little Golden Superhero Award (photos coming soon) and they really want to win it.
Neck and neck are Support Services and Academic Administration in second. I like to think I had something to do with that. I made it very clear in the last IT Services department meeting that the trophy was uber cool. I also pointed out how embarrassing it would be to not make a respectable showing on the Leaderboard. My team responded.
I would like to thank everyone that braved the weather and came out for the Summit. I emailed codes to those who registered. If you just dropped in and didn’t register, email me to receive your code. I know who attended, so don’t try and snow me into saying you were there if you weren’t. If you were unable to catch the Summit talks, I will be posting the recordings on the Summit web page. I will let you know once they are up.
Lastly, don’t forget to get your team together for Hack the Box. I am canceling Oct 9th’s event due to lack of registration. However the Oct 16 and 25 time slots are filling up. Book before it’s too late. You don’t want to miss out on a contest entry code.
Happy Thanksgiving!!
Adware Doctor and Trend Micro apps quietly uploading data – 09/13/18
Adware a very popular app on the macOS App Store, has been quietly sending browser history, a list of software you have downloaded and a list of processes running on your computer to a server in China. Unfortunately, this is only one of several apps that are collecting user data without our knowledge, a clear violation of Apple’s policies. You can add Trend Micro’s Dr. Cleaner, Dr. Cleaner Pro, Dr. Antivirus, Dr Unarchiver, Dr. Battery and Duplicate Finder to the list.
The good news is they have been removed from the App Store. The bad news is, you may have downloaded an app that is behaving badly. Just like Android and PC users, Mac users must be cautious when downloading apps. Just because it is in the App Store, doesn’t mean it is safe. Reviews and the number of downloads aren’t always reliable either. Always be wary of apps that access data that it really doesn’t need to function.
Thankfully, the next version of the macOS, Mojave is supposed to require apps to get the explicit approval of users before they start collecting and shipping off sensitive data. Yet another reason to keep your eye out for it and update as soon as it comes out.
Kids and cell phones, how to keep them safe – 08/08/18
As parents gleefully start planning for back to school, one question that may come up is ‘Does my child need a cell phone?’. If your answer is yes, there are some things that you can do to help protect them from cyber bullies, predators and scammers.
- Enable the password protected screen lock. Let your child know that the password should not be shared with anyone but Mom or Dad.
- Know every app on your child’s phone, every account that is created and what the passwords are.
- Check your child’s phone for disturbing content on a regular basis. Their access to a phone should depend on you having access to it as well. You pay the bills, you make the rules.
- Check the privacy and security settings on the phone and apps. Be careful with location tracking. If you can find your child, so can someone else.
- Keep the apps and phone software up to date.
- Have a talk with your kids about online safety. Teach them to:
- Never respond to calls, texts or emails from people they don’t know.
- Talk to them about cyber bullying, harassment and predators. Make sure they know they can come to you for help.
- Be careful about what they post. Too much personal information can make them vulnerable. Posting the wrong photo or making the wrong comment can mess up your life.
- Only connect to people through social media that they know.
- Watch for geo-tagging on photos. They don’t want their exact location to be displayed.
Even if you don’t follow all these guidelines, having a frank and honest discussion about phone safety and modeling desired behavior will go a long way to keeping your kids safe. For more resources on determining when is the right time for a cell phone and how to keep your kids and teens cyber safe, visit Safe Search Kids by Google.