AirDrop vulnerability is an easy avenue for hackers to exploit Apple devices

Recently, an alarming vulnerability has cropped up on iOS devices. This security loophole allows an attacker to overwrite arbitrary files on a targeted device and, when used in combination with other procedures, install a signed app that devices will trust without presenting a warning notification to users.

In a recent article published on Threatpost, it’s noted that the vulnerability is located in a library that lies within both iOS and OS X. In this case, the library in question is AirDrop, the tool featured on Apple devices that allows users to directly send files to fellow Apple device quickly and effortlessly.

The problem lies within the fact that Airdrop doesn’t use a sandboxing mechanism in the same way that many other iOS applications do. When making use of a sandbox, every application has its own container for files that it can’t get beyond the so-called “walls“ of.

AirDrop gives users to the choice to accept file transfers either from only their own contacts or anyone who sends them a request to send files. In the case that a user can receive files from anyone, it’s quite easy for an attacker to exploit their device on their locked iOS device.What’s more, the attacker can even make the attack without the user agreeing to accept a file transferred using AirDrop.

Directory traversal attacks make the exploitation of this vulnerability possibleMark Dowd, the security researcher who discovered the vulnerability, has been able to repeatedly and reliably exploit the security flaw. The vulnerability allows the attacker to execute a directory traversal attack, in which the attacker attempts to access files that are not intended to be accessed. Thus, the attackers are capable of writing files to any location they choose on the file system.

Since sandboxing rules weren’t being strictly enforced on AirDrop, Dowd was able to read/write hidden system resources in combination with his own directory traversal attack. In doing so, he was able to upload his own application into the system and make it appear as trusted.

This bug has been reported to Apple, but a full patch has not yet been released for the recently-launched iOS 9. Therefore, if you’re the owner of one or more Apple devices, make sure that your AirDrop sharing options are set to private and that you’re only able to receive files from your contact list.

Apple passcode increased to 6-digits in new iOS release

Apple rolled out its new iOS 9 operating system Wednesday and with that comes a big security upgrade.

The new operating system will now automatically default to a six digit PIN to unlock your device, instead of just a four digit PIN. While this might seem like a small change, it actually makes breaking into your iPhone a lot more difficult.

With a four digit PIN, there are a possible 10,000 combinations. But with a six digit code, there are 1 million possible combos, making it a lot tougher for someone to crack your security code.

If you are currently using a four digit PIN and update your software, you will need to manually opt in for the six digit PIN.

You can do this in your settings under "Passcode." But if you are just enabling the feature it will automatically prompt you to use six numbers for your PIN.

While the six number passcode is not mandatory, it is highly recommended. If you would rather take your chances, though, and go with a four digit code, you can make that selection in your settings as well.

The tech giant is also rolling out built-in two-factor authentication as part of iOS 9. Once you enroll for the security feature, you will be prompted to enter a verification code each time you log into a new device or browser. The code will appear on your other Apple device or your phone.

Deaths linked to Ashley Madison Hack

The data breach at Ashley Madison has escalated (with juicy data dumps!), and is feared to have driven two more people to suicide, following a Texas resident taking his own life last week.

Previously covered here and here. 

Malaysia takes the lead as the most cyber-savvy Asian nation while Indonesia is on the bottom rung

While 93% of online users in Asia worry about cyber security, 3 out of 5 consumers are unable to answer basic cyber security questions correctly, according to the ESET Asia Cyber Savviness Report 2015.

The survey also underlines that the region still has a long way to go in understanding online security and protecting themselves.

Polling 1,800 respondents from across Hong Kong, India, Indonesia, Malaysia, Singapore, and Thailand, the survey aimed to gain insights into the attitudes, knowledge and user behaviours across Asia when it comes to cyber security.

Despite the fact that Asia-Pacific region has the highest number of internet users in the world, the results of the study show that users in this region don’t know how to stay safe online. Moreover, a large  share of those  polled  commit basic mistakes like using passwords containing easy to access personal information, such as their date of birth or surname, storing passwords and credit card details online, and connecting to unsecured public wi-fi networks.

ESET’s study ranked Malaysia as the most ‘cyber-savvy‘nation in Asia-Pacific, ahead of Singapore, India, Thailand, Hong Kong, and Indonesia in that order. Cyber-savviness is based on factors such as the ability to understand activities likely to make them vulnerable online, risky behaviours while surfing the web, and the steps users take to protect themselves online.

Surprisingly, the results showed that consumers in countries with higher cyber savviness didn’t necessarily take all the right precautions, nor were they fully aware of the cyber security risks that common online activities pose. For example, users in India and Indonesia, take the highest number of precautions despite having the lowest levels of cyber security awareness. On the other hand, countries like Malaysia, Singapore and Thailand, which ranked amongst the top in ESET’s awareness survey came in near the bottom when it came to protecting themselves.

“We need to bust some myths about online security,” said Parvinder Walia, Sales Director APAC at ESET. “The ESET Asia Cyber Savviness Report 2015 found that users in Asia-Pacific tend to take unnecessary risks when they’re online, partly due to a lack of awareness. Users have the dangerous misconception that their personal accounts and activities are not likely to be a target for hackers or might be trading security for convenience. This has to change.”

“Information today is available at the touch of a button and the Internet is simplifying our day-to-day lives. Being aware and taking simple precautions will mean that users can stay protected online and feel confident as they take advantage of all that the Internet has to offer,” added Walia.

More education needed to boost cyber security awareness 
The study quizzed respondents about common safety risks online in order to find out how much they actually know about cyber security. Across the region, while 68 percent of online users said that they are aware of online security issues, they were unable to answer questions regarding cyber security practices.

In the Asia-Pacific region, the lack of formal education is a huge issue as 4 in 10 online users said they gained most of their information about online security through unofficial sources such as doing their own online research or from their families and acquaintances.

On an encouraging note, over 78 percent of the surveyed respondents that didn’t have any formal training about cyber security, said they were keen to learn more.

Ashley Madison 2.0 - Hackers Leak 20GB Data Dump, Including CEO's Emails

The group of hackers behind the breach of Ashley Madison, the popular cheater's dating service, have released a second, even much bigger 'cheat sheet' exposing sensitive materials that include sensitive corporate information.

Two days ago, the hackers released nearly 10GB of its customers' personal data online, which included 36 million emails and hashed passwords, 9.6 Million Credit Card Transactions records and their associated usernames.

Nearly 20GB of Ashley Madison Internal Data LEAKED
This time, the Impact Team leaked nearly 20GB worth of what appears to be internal data – not customers' data – from the adultery website on the dark Web
.
The leaked data appears to include the source code for the site, as well as a massive amount of e-mail from Ashley Madison parent company's Avid Life Media CEO Noel Biderman.
According to the researcher, who analysed the leaked data, the TL;DR of the leak is:

• The leak contains lots of Source Code
• 73 different git repositories are present
• Ashley Madison used gitlab internally
• The 13GB compressed file appears to contain Ashley Madison CEO's emails seems corrupted
• The leak contains plain text or poorly hashed (md5) db credentials

Personal Emails of Avid Life Media CEO Noel Biderman Exposed
The trove of information was dumped with a taunting message to the adultery website's founder posted on the same dark web hosting the earlier data dump. The message reads:

"Hey Noel, you can admit it's real now." – presumably directed at CEO Noel Biderman, who has refused to recognize the data is all legitimate.

Dave Kennedy, the founder of cyber security company TrustedSec LLC, has analysed the second data dump and confirmed that it contained nearly 1GB of Biderman's emails.

"The dump appears to contain all of the business/corporate e-mails, the source code for all of [Avid Life Media's] websites, mobile applications, and more," TrustedSec wrote in its official blog post published yesterday.

This is really interesting; having the complete source code to these websites means that hackers now are capable of finding new security holes in Avid Life's websites, and further compromise them more.

However, we have yet to wait for a response to this new release from Avid Life Media officials. If they do, this post will be updated accordingly.

A New Company Called Alphabet Now Owns Google

Well, this was a very unexpected move by Google.

Google Co-Founder Larry Page announced a restructuring of the whole company, revealing the creation of the umbrella "Alphabet" corporation.

But, don’t worry… Google isn’t dead! Rather, Google will become part of Alphabet.

Why Google Rebrands As ‘Alphabet’
Over time, Google, the Mountain View company has become a lot more than just a Search Engine.

Google created and acquired a large number of other popular Internet services, including Android, YouTube and Gmail, that makes too much difficult for a single company to manage all of them effectively.

According to Google Founders, it’s time, when different projects require different leaders, different company cultures, and different types of resources.

"Our model is to have a strong CEO, who runs each business, with Sergey and me in service to them as needed," Page wrote.

So the founders decided to create an all new parental brand that will manage both Google as well as its other far-flung projects — called ‘Alphabet’, going to be the biggest tech company most people have never heard of.

As a part of the new structure, Alphabet will manage Google and all of its other products, including:

• Google
• Calico, an anti-aging biotech Research Division
• Nest, Google's Smart-Home project
• Sidewalk, a company, focused on Smart Cities
• Fiber, Company for High-speed Internet services
• Investment arms, such as Google Capital and Google Ventures
• R&D unit, such as Google X, developing Self-driving cars and Drones.
• Alphabet Inc. will replace Google Inc. as the publicly traded company on the Nasdaq Stock Exchange, and shareholders will get one Alphabet share for every Google share they previously owned.

G is for 'Google' and 'Sundar Pichai 'is New CEO
Google’s senior vice president Sundar Pichai (Pichai Sundararajan), currently senior vice president of products, will be the new CEO of the Search Engine.

Google is now a more coherent company than it was previous. Google will now include the company's core businesses, including:

• Search Engine
• Advertising, Adwords, and Adsense
• Google Maps
• YouTube, the Video Service
• Android, Mobile operating system
• Chrome operating system
• related technical infrastructure.

And the current CEO Larry Page will become Alphabet’s CEO. Co-founder Sergey Brin will be its president, and Eric Schmidt will be the executive chairman of Alphabet.

"It is clear to us and our board that it is time for Sundar to be CEO of Google," Larry Page wrote in the open letter announcing the creation of Alphabet.

"Google itself is also making all sorts of new products and I know Sundar will always be focused on innovation—continuing to stretch boundaries. I know he deeply cares that we can continue to make 
big strides on our core mission to organize the world's information."

The 43-year-old Sundar Pichai rose quickly at Google, from working with the Chrome team to lead both the team as well as Android as senior vice president of Products.

The Launch of Alphabet Inc. will not affect you at all, but Good news… the company’s shares jumped 6 percent after hours, adding tens of billions of dollars to its value.