Google Just Made Gmail the Most Secure Email Provider on the Planet

Anyone with a Gmail account can now activate what the company calls “Advanced Protection,” a set of features that make it harder to hack into your Google account. These are aimed specifically at “high-risk” users, as Google puts it. That is political campaign staffers, activists, journalists, or people in abusive relationships.

The main advantage in terms of security is the need for a key or token to log in as the second factor, instead of a code sent via SMS or via app. This is much better because there’s no way for hackers to steal or phish this key from afar (there have been isolated incidents of hackers using social engineering to gain access to someone’s cell phone number by getting the provider to issue a new SIM card, for instance).

Thanks to these new features, Gmail is now the most secure email provider available on the internet if you are worried about hackers breaking into your private correspondence.

Source:

https://motherboard.vice.com/en_us/article/kz74ym/google-gmail-advanced-protection-security-keys-yubikeygmail-advanced-protection-security-keys-yubikey

Posted in Internet, Security | No Comments

KRACK Attack Devastates Wi-Fi Security

A devastating weakness plagues the WPA2 protocol used to secure all modern Wi-Fi networks, and it can be abused to decrypt traffic from enterprise and consumer networks with varying degrees of difficulty.

Not only can attackers peek at supposedly encrypted traffic to steal credentials and payment card data, for example, but in some setups, a third party could also inject malicious code or manipulate data on the wireless network.

Some vendors have already issued security updates and users are advised to patch immediately. U.S. CERT has published a list of affected vendors, but users should note the list is not comprehensive.

Source:
https://threatpost.com/krack-attack-devastates-wi-fi-security/128461/

Posted in Internet, Networking, Security | No Comments

How to use Let’s Encrypt to secure your websites

Securing your business website with HTTPS isn’t just a good idea, it’s a necessity. Google Chrome now marks HTTP payment and login pages and search pages as insecure if they’re not using HTTPS. Fortunately, Let’s Encrypt makes it both free and easy to lock down your websites.

After countless website security attacks, the Internet Security Research Group (ISRG) started the Let’s Encrypt project in 2015 to make it easy for everyone to secure their websites.

The ISRG’s members includes Akamai, Cisco, Electronic Frontier Foundation (EFF), and Mozilla; the group is managed by The Linux Foundation. The group’s purpose with Let’s Encrypt is to provide free, automated, and open security certificate authority (CA) for everyone’s benefit. Let’s Encrypt enables website owners to obtain security certificates within minutes, enabling a safer web experience for all.

As ISRG executive director Josh Aas said when the group was founded, “Encryption should be the default for the web. The web is a complicated place these days; it’s difficult for consumers to be in control of their data. The only reliable strategy for making sure that everyone’s private data and information is protected while in transit over the web is to encrypt everything.”

It worked. Two years after Let’s Encrypt issued its first certificate, it has today issued more than 100 million certificates. Indeed, Let’s Encrypt is now the biggest CA of them all.

So how can you use it to protect your website?

Source:
http://www.zdnet.com/article/how-to-use-lets-encrypt-to-secure-your-websites/

Posted in Internet, Networking, Privacy, Security | No Comments

Hackers backdoored CCleaner for a month: Over 2 million infected with malware

Hackers backdoored the popular CCleaner Windows utility; for nearly a month, two malware-tainted versions collected computer names, IP addresses, lists of installed and active software as well lists of network adapters before sending the data to attacker’s server.

Cisco Talos, which discovered the malware on September 13 while a customer was beta testing new exploit detection technology, warned that the tainted versions of CCleaner were being distributed for nearly a month. CCleaner 5.33 was released on August 15 and a newer version without compromised code wasn’t released until September 12. A cloud version released in August was similarly infected.

Source:

https://www.csoonline.com/article/3225914/security/hackers-backdoored-ccleaner-for-a-month-over-2-million-infected-with-malware.amp.html

Posted in Internet, Security | No Comments

5.3 billion devices at risk for invisible, infectious Bluetooth attack

What spreads through the air, is invisible to users, and requires no user interaction— no clicking, no pairing, no downloading, not even turning on discoverable mode— but could bring the hurt to billions of devices? It’s an attack vector dubbed Blueborne. Researchers revealed eight different bugs that affect the Bluetooth of more than 5.3 billion devices, including Android, Windows, Linux and iOS.

IoT security company Armis warned that all it takes is having Bluetooth on, and within 10 seconds, your device could be pwned from 32 feet away. And it’s wormable, a regular walking worm, meaning one infected device could spread it to others. While that already sound ominous, Armis gave a scenario that included the infection spreading ransomware from Bluetooth-enabled device to device.

The flaws are not in the Bluetooth protocol, but in the stacks — the Bluetooth implementations. The researchers discovered four of the flaws in Android’s Bluetooth stacks, one in Windows, one in iOS and two in Linux. They are not just talking about desktops, laptops and phones; Armis warned that Bluetooth “is used by devices of all kinds, from regular computers and mobile devices to IoT devices such as TVs, watches, cars and even medical appliances.”

Source:
https://www.csoonline.com/article/3224365/security/53-billion-devices-at-risk-for-invisible-infectious-bluetooth-attack.html

Posted in Internet, Linux, Mobile, Security, Windows | No Comments