October is a pretty spooky month most years, but this year certainly takes the cake. Besides the continuing pandemic, and the myriad ways it is affecting our lives—there’s a full moon on Halloween this year. Hats off to you 2020. Which means it should be no surprise to you that this month had some pretty scary stuff in the security world too.
Let’s get to it.
The new Absolute Control® mobile app lets you tap into all the power Absolute gives you, but from your phone. Read: Secure At-Risk Devices using the Absolute Control Mobile App. How many times have you had an issue pop up when you’re not at your desk? How about after work hours? Too many to count, for sure. The Absolute Control app lets you:
- Lock down a potentially compromised device
- Check if your endpoint security tools are running as they should
- Unlock and restore access to devices once a threat has been resolved.
Absolute Control doesn’t replace the things you do through your usual dashboard, but it does give you a way to quickly contain a potential threat before it gets out of hand.
The school year is in full swing and, unfortunately, schools are targets for ransomware, just like any other business. Continuing its long-standing support for endpoint security in education, we have 4 Ways to Protect Your School from Ransomware. None of the steps are hard or time consuming, and if you’re an Absolute customer you’re more than halfway there. Simple things like encrypting hard disks and making sure everyone is keeping machines up to date goes a long way in protecting the entire network.
The U.S government has indicted Russian hacking group Sandworm for attacking the 2018 Winter Olympics, Ukraine’s power grid, and more. The coverage from Wired is interesting, but what is really scary is the secret test in 2007 that used 140Kb (about 30 lines) of code to literally cause an electrical generator to self-destruct. Ukraine got off easy, they could recover from the attack and black out, but the 2007 Aurora test demonstrated it doesn’t take much to cause significant, unrepairable damage to critical systems. Disabling the power grid’s computers is one thing, damaging entire power plants beyond repair is a nightmare.
There are new phishing attacks, including some targeted at Office365/Teams users, we all have to be on the lookout for. We’re now seeing phishing attacks using Instagram, Canva, and now vphishing attacks, where scammers call employees and get them to change settings. Vphishing is particularly insidious right now with everyone working from home, having someone from IT calling from their own phone wouldn’t be unusual. Just another reminder for everyone to be on their toes. As this Forbes article reminds us—general awareness of cybersecurity is our best defense against hackers.
In the good news department, a group of global volunteers are helping hospitals recover from ransomware attacks. Front line workers have enough to worry about with an organic virus running amuck, throwing a cyber virus into the mix is just too much. Related to this is news that ransomware attacks are significantly under reported to police. Businesses seem to rather pay up and keep police out of it than face the potential embarrassment and PR nightmare that reporting the crime could trigger. This is a problem for a host of reasons, but maybe not the least of which it hampers efforts to track down and fight cyber criminals.
Apple has had an interesting month. Hackers claim to have jailbroken Apple’s T2 security chip. Which is very troubling. Hackers need physical access to your Mac to pull it off, but a fake USB-C cable is all that’s needed. The scary part here is with the T2 chip compromised, even encrypted data isn’t safe.
You can recover from the jailbreak, but it requires you to run Apple Configurator on your machine, but first you’d have to suspect you’ve attacked. And if you’re waiting for Apple to release a patch to fix this—they can’t. This is unpatchable. It’s a hardware instruction and permissions hack. The only way to fix it is to fix the chip. Newer Macs might be okay in the future, but right now … don’t let strangers plug USB devices into your machine.
On the plus side, five white hat hackers found over 55 bugs in Apple products netting them over a quarter of a million dollars in bug bounty fees. Bug bounty programs are a great way to find and smash bugs in apps. Software is too complex for regular QA and testing to fight everything, offering cash and bragging rights for finding issues (and so they can be patched) seems like a win-win.
Finally, Cory Doctorow talked with The Guardian about his new book, Attack Surface. The big take away is, techies, we don’t listen enough to non-technical people. Beyond how bad we are at naming things, ideas like planning for the reopening of schools based on computer models but forgetting that kids are inherently unpredictable will always go wrong. Why would anyone want to taste another kid’s boogers? Don’t know, but I’ll bet there are some 6–10 year olds out there who think it’s worth a try. Anytime you think “no one would ever do that”, you can bet someone will. From the Social Dilemma to the growing concern over tech monopolies, things are changing and we need to listen to all kinds of people if we’re going to do better next time.
Until next time…