Tag Archive for: trusted

The NSA wants its algorithms to be a global IoT standard. But they’re simply not trusted

/in
Nsa iot The NSA wants its algorithms to be a global IoT standard. But they're simply not trusted

Part of the concern is that the Simon and Speck algorithms might contain encryption backdoors that would be abused by US authorities.

Read more in my article on the Bitdefender Box blog.

Graham Cluley

Majority of Android VPNs can’t be trusted to make users more secure

/in

(credit: Ron Amadeo)

Over the past half-decade, a growing number of ordinary people have come to regard virtual private networking software as an essential protection against all-too-easy attacks that intercept sensitive data or inject malicious code into incoming traffic. Now, a comprehensive study of almost 300 VPN apps downloaded by millions of Android users from Google’s official Play Market finds that the vast majority of them can’t be fully trusted. Some of them don’t work at all.

According to a research paper that analyzed the source-code and network behavior of 283 VPN apps for Android:

  • 18 percent didn’t encrypt traffic at all, a failure that left users wide open to man-in-the-middle attacks when connected to Wi-Fi hotspots or other types of unsecured networks
  • 16 percent injected code into users’ Web traffic to accomplish a variety of objectives, such as image transcoding, which is often intended to make graphic files load more quickly. Two of the apps injected JavaScript code that delivered ads and tracked user behavior. JavaScript is a powerful programming language that can easily be used maliciously
  • 84 percent leaked traffic based on the next-generation IPv6 internet protocol, and 66 percent don’t stop the spilling of domain name system-related data, again leaving that data vulnerable to monitoring or manipulation
  • Of the 67 percent of VPN products that specifically listed enhanced privacy as a benefit, 75 percent of them used third-party tracking libraries to monitor users’ online activities. 82 percent required user permissions to sensitive resources such as user accounts and text messages
  • 38 percent contained code that was classified as malicious by VirusTotal, a Google-owned service that aggregates the scanning capabilities of more than 100 antivirus tools
  • Four of the apps installed digital certificates that caused the apps to intercept and decrypt transport layer security traffic sent between the phones and encrypted websites
Apps that intercepted and decrypted TLS traffic.

Apps that intercepted and decrypted TLS traffic.

The researchers—from Australia’s Commonwealth Scientific and Industrial Research Organization, the University of South Wales, and the University of California at Berkeley—wrote in their report:

Read 3 remaining paragraphs | Comments

Technology Lab – Ars Technica

Stuxnet reached its target via the networks of trusted business partners

/in

Stuxnet, the powerful malware that wormed its way in and hobbled Iran’s uranium enrichment efforts, infiltrated the secure networks of the nuclear program via trusted partners, newly public information reveals.

Once machines in five partner networks had been infected, Stuxnet found its way into Iran’s Natanz refining plant where it force automated control machines to run uranium enrichment centrifuges at speeds that would damage them, according to a blog written by Alex Gostev, Chief Security Expert at Kaspersky Lab.

+ Also on Network World: Apple was warned about WireLurker months ago, Georgia Tech researcher says |Raids cast doubt on the integrity of TOR +

To read this article in full or to leave a comment, please click here

Network World Tim Greene