FTC finalizes charges against Snapchat over user privacy

The FTC has approved final charges against Snapchat after the company's lax security policies were exposed, placing user data at risk.

In an advisory posted 31 Dec, the Federal Trade Commission (FTC) revealed final charges set against the messaging app company. The Snapchat app billed itself as a way of sending messages -- 'snaps' -- which would self-destruct within a set timeframe after being viewed by the recipient.

However, we discovered last year that this isn't exactly the case -- as a third-party app could be used to view the Snapchat directory and recover messages which were meant to have vanished.

Naturally, users were not best pleased at the idea their personal messages, which were not meant to exist, could be extracted and stored. It seems the FTC wasn't happy either, as it could be argued that users were misled over the protection of their data when using the Snapchat app.

The FTC says that Snapchat "deceived consumers with promises about the disappearing nature of messages sent through the service," and "Snapchat also deceived consumers over the amount of personal data it collected and the security measures taken to protect that data from misuse and unauthorized disclosure."

In other words, Snapchat wasn't clear when it comes to your entire contact list being accessed and lifted from your mobile device.

Following a public comment period and a unanimous vote hosted by the Commission, the US consumer watchdog and Snapchat have finally settled the matter. Snapchat has agreed to revise its privacy policy and submit to monitoring by an independent privacy service for the next 20 years.

The company is also banned from "misrepresenting" itself in how user security, privacy and confidentiality is maintained.

In November, Snapchat also issued an outright ban on third-party apps linking to the Snapchat platform, and promised to start freezing the accounts of users who refused to comply with the new rules. Snapchat was forced to take action following a mass hack dubbed the "Snappening" which saw a database containing over 100,000 images and videos sent across Snapchat leaked online for the titillation of the masses.

Snapchat was also made to apologize after 4.6 million Snapchat usernames and matched phone numbers were leaked at the start of 2014.

There are no fines on the horizon, but this case should remind companies that user privacy in a post-Snowden era is a top concern and security should not be ignored.

Top 4 tech habits you need to break right now

It's a brand new year, so why not start it off right by ditching the shackles of old habits and trying some new things to make your tech life easier? We know that old habits die hard and that's why we've also included links to show you how to handle these common practices

1. Using the same passwords for multiple sites

Using the same password on multiple sites is trouble because if any one of those sites is hacked, that information could be used against you in many different places. Yes, it's inconvenient to have multiple passwords if you are relying only on your memory. That's why it's a good idea to give a password manager like LastPass a chance. If you've never tried a password manager, it can store your usernames and passwords for you, it can generate new passwords for you, and is accessible online. Here's our tutorial on how to use LastPass if you're up for a change.

2. Not backing up your photos

I'll never forget the panic of almost losing hundreds of photos of my newborn because I didn't regularly sync my phone to my PC. Nowadays, that is a simple problem to overcome. If your phone is your primary camera (like it is for many), do yourself a favor and download an app that will automatically backup your photos and videos to the cloud.

There are plenty of options out there. If you like Google, you can use either Google+ on iOS or the Photos app on Android to set up auto backup. Dropbox also offers the same functionality if you turn on the camera upload option. If you're an Amazon Prime subscriber, you get unlimited storage of your photos as well with the Amazon Cloud Drive app.

3. Not minding your Facebook settings

It's easy to visit Facebook, see what your friends are up to, and post your own status updates. However, when was the last time you took a look to see what content you were posting and who could see it? Diving into those Facebook settings can seem like a nightmare, but we've got a great article on how to secure your Facebook account that you should take a look at.

4. Running Flash all the time on your laptop

We are all fans of running online video on our computers, but sometimes Flash can cause your computers fans to spin up to try to cool down your PC. You should give up having Flash running all the time. If you're on Google Chrome, try out FlashControl. If you're on Firefox, try out FlashBlock. By default, these plugins will not load Flash content on a page unless you put a site on a whitelist or if you click the Flash item to load it. You'd be surprised how much battery life you can save if you turn off Flash on a number of sites. Be warned that the web might look very different to you at first, but it's definitely worth it. If you want to squeeze more battery life out of your laptop or phones, check out our guide on battery life and how to preserve it.

Bonus for Android users: Accepting your phone's default interface.

If you're like the majority of people who use Android smartphones, you may just enjoy all the great apps on your phone. But, did you know that you can change the entire way your phone presents your apps and widgets? Manufacturers like Samsung, HTC and LG all put their spin on Android with their own customizations. However, you can modify your phone by trying any number of launchers. If you've never heard of a launcher, here's everything you need to know about Android launchers. Installing one is as easy as installing any other app and you can always go back to your phone's default if you so choose.

Android malware threat rears its head again — and this time it means business

A malware threat first observed in 2012 has evolved and hijacked more than 4 million Android devices to send spam emails, buy event tickets in bulk and crack WordPress accounts. In its new and improved form, the threat is now putting enterprise networks at risk.

Mobile security firm Lookout
first discovered NotCompatible
in 2012 (variant “A”), when the malware disguised itself as a system update, which if downloaded turned the infected device into an attacker-controlled proxy. “We’ve seen increasingly sophisticated threats emerging – for the first time ever, we witnessed malware writers targeting the mobile Web via compromised or infected websites with the NotCompatible threat,” said Derek Halliday, senior product manager at Lookout, in an interview with Digital Trends back in August 2012.

Since then, Lookout has tracked the NotCompatible threat and is now reporting the emergence of NotCompatible.C, the newest iteration of the malware. What makes NotCompatible.C a bigger threat than the original version is its ability to infiltrate secure enterprise networks by way of infected devices.

“NotCompatible.C is ultimately a botnet-for-rent; though the server architecture, peer-to-peer communications, and encryption make it a much more formidable threat,” according to Lookout. In other words, the new version of NotCompatible makes it more difficult for network security systems to detect and block.

Spam email blasts and compromised websites are the delivery channels for the “drive-by-downloads” that infect devices with NotCompatible.C. The malware relies on the gullibility of Android users – for instance, including a link to an Android application package (APK) in an email about weight loss solutions.

The malware is costly for owners of infected Android phones. Not only does it use data that counts against a user’s carrier plan, it also drains a phone’s battery.

Lookout offers two strategies to protect against NotCompatible.C: use an advanced mobile security platform to detect the threat at device level and segment networks to limit the potential reach of an infected device. Lookout says its mobile app is able to defend Android devices from NotCompatible.C.

To read a more detailed analysis of the NotCompatible.C threat, read Lookout’s report.

Lookout’s report about NotCompatible.C is hardly alone in sounding the warning bell for Android users. According to online security firm F-Secure, 99 percent of mobile malware threats in Q1 2014 were designed to run on Android devices. Meanwhile, Cheetah Mobile, a company that makes mobile apps to clean, protect and optimize phones, recently reported that 9 percent of Android apps are fully or partially malware.

U.S. Authorities Are Reportedly Gathering Phone Data Using Fake Celltowers On Planes

Edward Snowden may have gone public with his NSA leaks more than 18 months ago, but the rate at which we learn new information about government spying programs shows little sign of slowing. Witness today, the Wall Street Journal published a report claiming that the U.S. Justice Department is “snagging [mobile data belonging to] a large number of innocent Americans’” via technology that can identify criminal suspects using planes.

The WSJ cites sources who claim that the U.S. Marshals Service is using fake cell towers on airplanes — dubbed ‘dirtboxes’ — in order to access data from phones located on the ground.

Essentially, the dirtboxes pose as legitimate network operators, providing signal to devices which, it is claimed, can allow them to prize registration and identification information from a ‘target’. When successful, this removes the time-consuming need to go through mobile operators to gain these details during searches for suspects, it is argued.

The latest version of the technology can even interrupt signals and grab information, such as text messages or photos from a device, the WSJ says, although modifications are said to enable 911 calls and other privacy allowances.

Image via Wall Street Journal

The technology, which has apparently been deployed in other fields by the military and is used on planes “on a regular basis”, is — like so many other security programs that have come to light over the past 18 months — described as a “dragnet” that also pulls in information from innocent people in the vicinity without so much as a court warrant or warning.

Though sources told the WSJ that data from ‘non-target’ phones is “let go”, it isn’t clear how that information is stored and the processes involved with its disposal. These are clearly important questions that need answers.

As ever, responses to this news will largely fall into two categorizes: those who believe that the U.S. — and other governments — should do everything within its power to find and apprehend criminals; and those who feel that the government is again running roughshod over privacy rights.

Certainly, if information from all cellphones accessed is being stored on file — and the WSJ was, importantly, not able to establish or report on that — then there’s significant cause for concern once again.

Samsung and BlackBerry team up for better Android security

Samsung is tapping an unlikely source to tighten up its security offerings for enterprises:BlackBerry.

The two companies announced a new security-focused partnership Thursday that will bring BlackBerry's encryption system to businesses using Samsung's Galaxy smartphones.

Beginning early next year, Samsung will integrate BlackBerry's BES12 end-to-end encryption service, into its own Knox software. Knox, which Samsung licenses to enterprise customers, adds an extra layer of security to Android devices— though the service has been criticized for weak encryption.

“BlackBerry has developed a very close partnership with Samsung and we’re committed to deepening the interaction between our engineering and product development teams for the long-term,” John Sims, BlackBerry's President of Global Enterprise Services, said in a statement.

“It is a natural progression in our path to providing our customers with more alternatives to meet their evolving mobile needs. Samsung KNOX offers a number of hardware and software security features and our partnership allows us to tightly integrate these capabilities with BES12.”

The seemingly unlikely partnership stands to benefit both companies. Samsung will be able to provide enterprise users with better security, while the ever-struggling BlackBerry will expand its software reach to new customers who don't use BlackBerry devices.

Samsung will begin to offer the software in early 2015, but the company has not revealed details about pricing.

Microsoft quietly patches potentially dangerous Windows security hole

Microsoft released 14 regular security updates for Windows on Tuesday, but one in particular shines a light on a sizable critical vulnerability that affects most widely-used versions of the operating system, including Windows 7, 8, 8.1, Vista, RT and more.

The patch addresses a security hole in Schannel, Windows' secure channel used for security protocols like encrypted communication, particularly for Internet applications that use HTTP.

Microsoft puts it this way: Attackers could send "specially crafted" data packets to the Windows server you're running. By exploiting this vulnerability, they could execute code remotely and deliver something nasty to your computer. On its security bulletin, Microsoft said there are no mitigating factors or workarounds to lessen the blow of these attacks.

There hasn't been any indication that the vulnerability has been used to attack the general public, according to Microsoft. The patch mends the problem by altering the way Windows processes packets. Just in time, too — from the sounds of it, this could have been bad. Other than that, Microsoft doesn't provide much more information about the vulnerability.

The patch comes over on Windows Update, so it's best for Windows users to run the scheduled update as they get a chance.

Samsung assures people that ‘Find My Mobile’ is perfectly safe

There have been recent reports that Samsung’s Find My Mobile service, which tracks and locks misplaced smartphones, was vulnerable to attacks from hackers. On its blog, Samsung not only announced that the service was patched, but that there is nothing to worry about.

According to Samsung, to hack Find My Mobile would require a specific set of circumstances to take place. Here’s how Samsung laid things out:
The attacker occupies a way to send a link containing malicious code.
The Find My Mobile user sets up Find My Mobile Remote control ‘ON’
The user enters his/her ID and password and logs on Find My Mobile website
The user clicks the link in e-mail/instant message/SMS sent by attackers

As can possibly be surmised, it seems to be a very specific set of circumstances that was unlikely to have affected many people. Even so, according to Samsung, no user information was compromised. The reported issue was patched on October 13, so Find My Mobile users don’t have much to fret about, other than losing their phones.

Spying And Police Requests For Facebook Data Up 24% Since 2013

Facebook continues to fight dragnets for private data by governments, but the combined number of requests from local law enforcement and federal spy agencies like the NSA went up 24 percent from the last half of 2013 to the first half of 2014, according to Facebook’s new government requests report. In the U.S., Facebook received 15,433 data requests about 23,667 accounts, and was forced to provide data for 80.15 percent of the requests.

Meanwhile, countries with local laws about objectionable content increased their requests to Facebook to restrict content by 19 percent, with the most coming from India, Pakistan and Turkey.

In the report, Facebook details how it’s still fighting what it calls an overly broad search warrant for data about suspects in a disability fraud case. Of the 381 people the goverment requested data about, only 62 were later charged, giving credence to Facebook’s argument that law enforcement overstepped its bounds by asking for data on so many people. Facebook writes that “Despite a setback in the lower court, we’re aggressively pursuing an appeal to a higher court to invalidate these sweeping warrants and to force the government to return the data it has seized.”

Unfortunately, the government won’t allow companies like Facebook to reveal the specific number of spy agency surveillance requests, and forces them to lump this number in with more benign requests for data for criminal cases like kidnappings and robberies. Facebook vows to continue pushing for more transparency around surveillance requests through the Reform Government Surveillance coalition. The company also hopes the government will pass the USA FREEDOM Act, which would limit bulk surveillance through requests by the FISA court.

While some believe Facebook is in bed with the spy agencies, CEO Mark Zuckerberg has repeatedly insisted that the social network only gives up data it’s legally required to and does not volunteer data or do anything to make its collections easier. Facebook’s mission and business model both depend on users trusting it with their personal data, so few are so incentivized to fight to keep that data private.

Whisper app tracks users’ locations, shares data with Department of Defense and FBI

Whisper’s promise of anonymity while sharing secrets via its app rings less true today than it did last week, thanks to a searing report from The Guardian about the app’s questionable tracking and use of user data. Among the revelations were that WhisperText (the company behind the app) tracks the location of users who have opted out of geolocation services and has shared user data with the FBI, MI5 and U.S. Department of Defense.

During a three-day visit to WhisperText’s Los Angeles headquarters to explore a broader journalistic relationship, two reporters from The Guardian discovered a number of unsavory things about how the company collects, tracks and shares user data.

Among the findings reported by The Guardian is that Whisper has created an in-house mapping tool that enables its employees to filter and search GPS data to location posters within 500 meters from where they shared their secrets. “The technology, for example, enables the company to monitor all the geolocated messages sent from the Pentagon and National Security Agency,” according to The Guardian. “It also allows Whisper to track an individual user’s movements over time.”

The news organization also reveals that Whisper posts users may believe to be deleted are collected, along with other user data, in a searchable database that goes all the way back to the app’s launch in 2012. While user names and phone numbers aren’t stored there, time and location stamps are.

The Guardian also learned that there have been occasions where the company has shared information with the FBI and MI5. Both cases involved threats to life, but Whisper’s terms of service (which have since been updated) indicated “the company appeared to require a lower legal threshold for providing user information to authorities than other tech companies.”

Whisper is also sharing information with researchers with the Department of Defense, who are examining mentions of suicide or self-harm that come from Whisper posts shared within U.S. military bases.

The company has since rewritten parts of its terms of service and rolled out a new privacy policy. The new policy tells Whisper’s users to “please bear in mind that, even if you have disabled location services, we may still determine your city, state, and country location based on your IP address (but not your exact location).”

Michael Heyward, CEO of WhisperText, responded to The Guardian on Saturday by saying, “We realize that we’re not infallible, and that reasonable people can disagree about a new and quickly evolving area like online anonymity. So we’re grateful to those who have shared thoughtful feedback over the last few days.”

As if publishing the report didn’t make it clear, The Guardian says it is no longer pursuing a relationship with Whisper.

Half of all Android devices still vulnerable to 'privacy disaster' browser bug

Over a month ago Google released patches for bugs affecting the built-in browser on all pre-KitKat devices, yet today half of all Android devices remain vulnerable, according to mobile security vendor Lookout.

The same origin policy (SOP) bug in the browser that ships
with all versions of below Android 4.4 illustrates yet again the patching problem in Android — often caused by slow-to-respond handset makers and carriers.

In early September security researcher Rafay Baloch discovered two bugs in the Android Open Source Project (AOSP) browser — called Browser in Android 4.3 and earlier — that meant it failed to enforce SOP. As Google notes, SOP is "perhaps the most important security concept within modern browsers" that's meant to securely govern how content from multiple domains is handled in a browser.

At the time, Todd Beardsley, a researcher with security firm Rapid 7, described the bug as a "privacy disaster", explaining that "any arbitrary website (say, one controlled by a spammer or a spy) can peek into the contents of any other web page". The bug also allowed an attacker to hijack a web session by stealing a session cookie.

Since the affected browser ships with all pre-KitKat versions of Android (Google dropped the browser in Android 4.4), it would mean that around 75 percent of all Android users with the Google Play app could be exposed to such an attack, according to Google's figures.

Google released patches for the two flaws shortly after researchers built an exploit for the bug and added it to the penetration testing framework Metasploit.

Despite a patch being available, carriers and handset makers often take their time to distribute that patch in a firmware update to end users. To make matters worse, other browsers built using the ASOP browser were also affected, including Samsung's browser as well as two others available on Google Play.

According to Lookout, whose Android security product has been installed on up to 100 million smartphones, the problem is worse in some countries than others. For example, in Japan, 81 percent of its users are running the vulnerable browser, while across Europe the figure is around 60 percent. In the US, 34 percent of Lookout users have it installed.

"Phones in those regions may receive updates less frequently, thus they are more likely to be vulnerable. The US, on the other hand, has a lower risk because the average age of phones is also much lower. Therefore, fewer of them are vulnerable," Lookout's Jeremy Linden and Meghan Kelly wrote in a blog post.

"Unless and until the AOSP browser is patched, people using it could be exposed to data theft or worse as a malicious attacker with access to an authenticated user session could take any action the user would on that site."

While they advise users running Android 4.3 to update to KitKat, as many Android users will know that's not always possible. The other option if an update isn't possible is to buy a newer device.

As per the advice from security experts at the time, the safest option is to disable the default Android browser since it's unlikely it can be uninstalled. After doing this, people should install an unaffected browser, such as Chrome or Firefox.

How You Can Avoid a BadUSB Attack

Thanks to a couple of enterprising (or thoughtless) security experts and hackers presenting at Derbycon in Louisville, Kentucky, last week, BadUSB is now out in the wild — Or at least downloadable on GitHub. It's enough to make your stomach turn and certainly
leave you wondering: How do I avoid BadUSB?

To know how to stop BadUSB, the seemingly unstoppable USB stick hack that can turn a USB memory stick into a system-lethal weapon, it's instructive to understand what it is and isn’t. BadUSB is not malware. It's not a file you can download from email or off an infected device that can then run rampant on your computer and network. BadUSB is, as the name suggests, a bad USB drive that has been altered to connect to a computer in ways that normal USBs do not.

If you plug such an altered USB into your computer it can, because it’s actually a tiny computer all by itself (as are all USBs), run commands, execute files and generally wreak havoc.

What can you do

While it's not easy to create these kinds of dangerous USB devices, it's also impossible for you to tell the difference between a regular USB and an altered one. Worse yet, since the files stored on the USB will not likely be infected, standard security software probably won't even detect that these are dangerous little pieces of hardware when you plug them into your computer.

We spoke to some security software firms about their best advice for avoiding BadUSB and their recommendations were remarkably analog.

Representatives from the Security Response team at Symantec, which makes the popular Norton family of security software products, acknowledged that traditional anti-virus technology can't "inspect the drivers running inside a USB device."

For consumers they recommend:

• Only insert trusted USB devices into computers 

• Do not use or purchase pre-owned USB devices (they could potentially contain malicious software). 

• Never leave your computer or mobile devices unlocked or unattended.

Security software company McAfee echoed Symantec's advice. Gary J. Davis, the company's chief consumer security evangelist, told us, "The best practical advice McAfee can give consumers regarding the BadUSB attack is to avoid thumb drives that are not from a credible source, such as a big box retailer or they have not previously used. Additionally, we would discourage consumers from using promotional thumb drives that are given away at events."

Davis' last bit of advice points to what may be one of the chief distribution vectors for BadUSB. Trade show exhibitors long ago gave up handing out pamphlets and folders to show goers and now favor bowls full of USB sticks pre-loaded with information about their products and services. Many of us simply grab every one of them in sight, knowing that we can wipe the data and reuse them for personal storage. However, what if there's a bowl full of BadUSB drives? Erasing the data will not remove the threat.



Until there's a technical fix for BadUSB, which likely means re-architecting the fundamentals of USB hardware, we may have to call a moratorium on free USB keys.

In the office

Businesses are, perhaps, even more vulnerable than homes. The USB drive is the 21st Century 3.5-inch floppy. While everyone is on a network, it's not unusual to sneakernet it and hand someone a USB drive with the needed file or presentation. And how often are we handing around reused USB sticks?

As Symantec's Security Response Team notes, though, there is a way around this practice.

Administrators can lock USB port use on Windows 7 and 8 PCs or they can install endpoint software like Symantec Endpoint Protection, which offers a device control module that prevents USB devices from mounting on systems. There are actually a wide variety of tools for system administrators including Safend Protector, Sophos Endpoint Security and Data Protection and Skyrecon StormShield Endpoint Security.

Fears over how to manage and share files and documents across a company and between partners without running into BadUSB may prompt more people to adopt the cloud. (Cloud storage is, of course, an Internet-only option for sharing and synchronizing all kinds of files. )

There's hope

If you do plug a BadUSB into your computer, there is a chance that security software could protect you. Symantec points out that while the BadUSB may be able to cloak its nefarious purpose, as soon as it tries installing or running malware on a protected system, resident security software should detect and block it. "So the threat may remain hidden," said one Symantec analyst, "but it will not be able to infect a protected machine."

At least in practice. In the meantime. it's unlikely anyone will stop using USB ports for storage and data transfer, but if USB goes from GitHub to your desktop, you'll want to change your USB stick-sharing ways.