Huawei ‘Shocked, Amused’ by Espionage Accusations

Huawei’s top executive in Europe brushed off Western critics and defended the company’s track record against accusations that it could serve as front for Chinese spying.

Huawei has raised suspicions in the west for its close ties to the Chinese government and fears are that the company may be an integral tool of the superpower’s international espionage capabilities.

“Recently Huawei has been under constant attack by some countries and politicians,” Huawei vice president and representative to the EU Abraham Liu said in a speech in Brussels.

“We are shocked or sometimes feel amused by those ungrounded and senseless allegations,” he added.

Liu said Huawei had an “excellent track record” and had won the solid endorsement of major European telcos Deutsche Telekom, British Telecom and Orange.

The executive also said that Huawei would open a “cyber security centre” in Brussels next month that will show that the company is “part of the solution, not part of the problem.”

The speech came just days after a team of US officials toured EU capitals — including Brussels — urging European governments to scrap Huawei technology from their telecom infrastructure plans.

The US considers the matter urgent as European Union countries prepare to roll out 5G networks that will deliver near-instantaneous connectivity, vast data capacity and futuristic technologies to Europeans.

Several other countries, under the pressure of the United States, have banned Huawei’s 5G equipment.

But dumping the telecom company comes at a cost as experts say Huawei is between six months and one year ahead of rivals in terms of the quality of 5G equipment.

Finland’s Nokia is said to be even further behind.

Deutsche Telekom, in an internal document obtained by Bloomberg, warned that Europe could fall behind China and the United States by as much as two years if it forgoes using Huawei’s 5G equipment.

Liu said Huawei hired 12,000 people in Europe and in 2018 procured $6.3 billion worth of goods in Europe.

US justice officials last month unveiled sweeping charges against Huawei, including against a top executive whose arrest in Canada on a US warrant ratcheted up tensions between the two superpowers.

In a case centring on Meng, Huawei is charged with violating US and UN prohibitions on trading with Iran.

Previous Columns by AFP:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/a4XdsI9CDSA/huawei-shocked-amused-espionage-accusations

Apple Patches FaceTime Spying Vulnerability

Apple has finally released an iOS update that should fully patch the Group FaceTime vulnerability that could have been exploited to spy on users through their device’s microphone and camera.

Apple described the flaw, tracked as CVE-2019-6223, as a logic issue in the handling of Group FaceTime calls. The company says the problem has been addressed with “improved state management.”

The bug allowed an attacker to spy on FaceTime users by calling the targeted user and adding the attacker’s own number to a group chat. While the hacker could hear and possibly even see the victim, on the victim’s side it appeared as if the call still hadn’t been answered.

Interestingly, Apple has credited both Grant Thompson, a 14-year-old from Arizona, and Daven Morris, or Arlington, Texas, for reporting the vulnerability.

Apple patches FaceTime vulnerability Thompson and his mother attempted to report the findings to Apple more than 10 days before details of the bug became public, but their attempts were ignored by the tech giant. Apple admitted that it dropped the ball in this case and promised to improve its vulnerability reporting process. It has also promised to pay Thompson a bug bounty, but it’s unclear if Morris will receive a bounty as well.

Apple disabled the Group FaceTime feature after learning of the flaw’s existence. It then implemented a server-side fix and now it has released updates for both iOS and macOS Mojave to fully address the issue. The Group FaceTime service has now been restored.

The iOS update (version 12.1.4) also patches two privilege escalation and code execution vulnerabilities that Google says have been exploited in the wild. One of these flaws has also been resolved in macOS Mojave.

While investigating the FaceTime bug, Apple also discovered an issue related to the Live Photos feature in FaceTime. The flaw, tracked as CVE-2019-7288, has been patched through “improved validation on the FaceTime server.”

The FaceTime bug has caused a lot of problems for Apple. A lawyer from Texas has filed a lawsuit against the company, claiming that the vulnerability was exploited to record a client’s private deposition.

Authorities in New York have launched an investigation into Apple’s slow response, and two lawmakers demand that the company be more transparent about how it handled this incident.

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/98itIUHCQGA/apple-patches-facetime-spying-vulnerability

Australia Wields Vast Decryption Powers Before Planned Review

Australian security agencies have begun using sweeping new powers to access encrypted communications, even before a promised review to address concerns from the likes of Google, Apple and Facebook.

The powers were granted under a new decryption law which was rushed through parliament in December amid fierce debate, and was seen as the latest salvo between governments and tech firms over national security and privacy.

Two months later, the Australian Federal Police have revealed that agents have already used it while investigating drug trafficking and child exploitation.

Under the fresh rules, refusal to grant authorities access to devices is punishable with up to 10 years in prison, and police told a parliamentary inquiry they had used that threat to compel two suspects to hand over their passwords.

Citing secrecy provisions in the law, police declined to say if they had used the new law to force device makers or telecommunications firms — including global giants like Apple — to break or bypass encrypted communications.

The same provisions bar industry from disclosing whether they have received such police demands, known as “compulsory notices”.

The government has argued the law was urgently needed to foil ongoing terrorist plots and intercept communications among other serious criminals.

But opponents allege it punches a hole in global efforts to keep governments from eavesdropping on secure communications, like WhatsApp chats.

They also argue it could undermine security by creating vulnerabilities in encryption technologies, which could then be exploited by malicious actors.

– Threat to industry –

The legislation was adopted only after the conservative government agreed to reopen debate in the new year on amendments that would address widespread concerns among civil liberties advocates and tech industry experts that it was ill-conceived and too broad.

The Department of Home Affairs says the law is being progressively implemented and that in January it wrote to tech industry members for assistance in drawing up guidelines on how to use the new powers.

“The Department is also engaging with industry to dispel common misconception, build confidence and to reiterate the intended purpose and operation of the Act,” it said in a submission to the parliamentary inquiry.

But the tech industry appears far from reassured.

“There is no doubt there is an extremely broad coalition of stakeholders that are very concerned about the impact of this bill,” said John Stanton, chief executive of the Communications Alliance, which represents the Australian communications industry.

“It is not just industry, it is civil society and digital rights activists (too).”

Stanton warned the new law posed “an enormous threat” to export opportunities for Australian tech firms “because they can no longer provide any assurance that their gear hasn’t been tampered with by Australian security”.

“Even to say, ‘no, it hasn’t’, is an offence” under the law,” he added.

Industry groups have combined forces to present a joint submission to the latest inquiry proposing a series of amendments.

These include a higher threshold for using the law, which can currently be applied in any investigation of an offence carrying a maximum three-year jail term — a bar critics say is too low.

The industry also wants more precision about an element of the law barring authorities from forcing companies to introduce a “system vulnerability” into their products — a term they say is ambiguous.

Australia is widely seen as a global test case for such laws, with possible applications by other governments seeking to counter the growing use of encrypted messaging, notably Australia’s partners in the so-called “Five Eyes” intelligence alliance — the United States, Britain, Canada and New Zealand.

The ongoing review of these powers by parliament’s Joint Committee on Intelligence and Security may have set an Australian political record.

It was launched just nine days after the encryption legislation became law and reflects the haste with which it was rammed through.

The committee must complete its review by April 3, but any moves to then amend the legislation risk running up against the Australian electoral cycle, with a federal election due by mid-May.

Previous Columns by AFP:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/Moa0IudXhQ4/australia-wields-vast-decryption-powers-planned-review

Cisco, like Apple and other tech giants, now wants new federal privacy law

On Thursday, Cisco formally joined the parade of major tech companies that have been calling for a comprehensive federal privacy law that would once and for all set a clear standard for tech companies nationwide.

Currently in the United States, there is a patchwork of laws governing how various types of data are handled—health, financial, etc.—but there isn’t a clear set of rules for Silicon Valley giants that traffic in vast amounts of information sharing. As a hardware networking giant, however, Cisco does not profit from user data in the same way that a company like Google or Facebook does.

In a blog post, Cisco’s top lawyer, Mark Chandler, called the current legal framework “not adequate.” Cisco hasn’t put forward specific bill language just yet; it is speaking for now in generalities.

Particularly in the wake of the Cambridge Analytica scandal, along with the recent passage of the GDPR in the European Union and California’s own new privacy law, companies have been pushing Congress to regulate their industry like never before. Some lawmakers have taken notice and have introduced their own bills, but none have gotten far in the process just yet. Other states, like Washington and Massachusetts, are proposing their own privacy bills, too.

“What we don’t need is more fracturing,” Michelle Dennedy, Cisco’s chief privacy officer, told Ars.

A former member of the Federal Trade Commission, Maureen Ohlhausen, told Ars that while the GDPR has “some good concepts,” it may not be fully appropriate for the US, as elements of the law can clash with the First Amendment. The GDPR also relies on each member state’s data protection authority, a government agency that the United States lacks.

In the US, the FTC is the de facto privacy regulator, but the primary way the agency enforces privacy under Article 5 of its legal mandate is largely to make sure that companies are complying with the privacy laws that they themselves outline in their lengthy terms of service. The FTC can enforce those rules under consent decrees.

“I think that many companies will be interested in an approach that focuses on consumer expectations rather than excessive notification, targets harmful uses of data, is technologically neutral, avoids a patchwork of laws that may fragment our successful national market, and gives the FTC some additional resources,” Ohlhausen said.

Still, Cisco and other companies’ sudden change of heart is somewhat odd, according to Ashkan Soltani, a former FTC technologist and current independent privacy researcher based in Oakland, California. Soltani helped author the new California Consumer Privacy Act of 2018 (CCPA), likely the strongest state-level regulation currently in place—it will take effect in January 2020.

“It’s ironic that for years, as long as I’ve been here, companies have said that we can self-regulate; we don’t need any federal regulation,” Soltani told Ars. “But then as soon as there are state initiatives, the companies are, like, ‘It’s time for federal regulation!’”

Soltani added that numerous companies are trying to lobby state capitals to shape both California’s law and those of other states that are putting forward similar measures, while at the same time trying to direct the federal government toward something palatable. “The ultimate worry is that, because of a combination of laws like CCPA and just the actions of the big players ruining or tainting the ecosystem, they want to get ahead and [not] disadvantage their specific industry,” he said.

That assertion tracks with what at least some privacy lawyers have observed.

“If you read between the lines, Cisco is calling for a law similar to GDPR,” Susan Lyon-Hintze, a Seattle-based attorney, told Ars. “They want an enforceable law, but enforceable by governmental agencies and not by individuals and plaintiff lawyers. Tech companies all want to avoid costly litigation.”

https://arstechnica.com/?p=1452421

You’re Opted in by Default – Know When and Where to Opt Out

There’s no doubt your information is out there. And at a certain point, you have to assume it’ll be exposed.

So now what? With everything that’s happened in cybersecurity over the past few years and in the wake of so many high profile breaches all over the world, it’s time for a shift in mindset.

As individuals and consumers, we can’t control everything. We can’t just go in and audit our banks, medical providers and creditors to ensure our personal information is secure. We can’t even avoid sharing our information in many cases.

But at the same time, we do have some control over our digital footprint—and of course over our own behavior, both online and in the real world. There are steps we can take to limit our risk.

The extent of that control depends largely on where you live, and your country or region’s level of privacy sophistication. In Europe today, because of the effects of GDPR and other regulations, online privacy is protected, and users must opt into the sharing of their information by third parties. With this, the decision to share personal information becomes a question of risk versus reward.

The U.S., however, remains an opt-out society. It is consumers’ responsibility to opt out of sharing their information with the services they join—and figuring out how to do so.

As soon as you are born in the U.S., for example, you are assigned a Social Security number for tax and employment purposes, and your information will be shared, by default, with the three major credit reporting bureaus. Since you’re in those databases, basically everyone in the world who offers credit can see your credit information for the purposes of marketing new offers to you.

But you do have some control. Opting out from unsolicited offers is a great way to mitigate risk of exposure, because it limits the organizations that can see your credit information to only those you’ve consented to.

The same thing goes with the apps on your phone, your search history in Google or Bing, and any online banking accounts you have. These are all services that are essential to modern life, but when you sign up or use these services, the default setting is to share your personal information. In the U.S. at least, your search history could always be used against you at some point. The onus is on you to read the fine print and figure out what kinds of information you can protect, and how and where you can opt out.

And what about social media? We all like to be a part of things and participate in our communities. But as soon as you join any social media platform, by default the information you share there is public. You have to go into the privacy settings and security controls to change that.

Yes, you have the choice, but by default you are sharing personal information with an organization that may or may not handle it with your best interests in mind. And even when you’ve locked it down, that information will still often be shared with advertisers.

And then there’s all those services working in the background, collecting information about your habits online and even in the physical world. Recently The Weather Channel was sued in Los Angeles (PDF) for unfairly sharing location data. How many apps do you have on your phone right now that you’ve allowed to track your location? Do you know how that information is being used or shared? What about satellite mapping services and “street views” of your home address?

So, should you delete all your social media accounts and apps, and go back to your old Nokia 3310? Should you abandon your bank card and pay for everything in cash?

Probably not, but the size of your digital footprint is something everyone should be thinking about. There is no doubt that eventually, any app or service you sign up for, whether it be social media, health, banking, or even your weather app, could be compromised and your information used against you. Your online choices could have long-term ramifications, just like your offline choices do.

Mitigating that exposure, at least in the U.S., boils down to taking the time to figure out what you need and what you don’t—and learning how and when to opt out.

Preston Hogue is Sr. Director of Security Marketing at F5 Networks and serves as a worldwide security evangelist for the company. Previously, he was a Security Product Manager at F5, specializing in network security Governance, Risk, and Compliance (GRC). He joined F5 in 2010 as a Security Architect and was responsible for designing F5’s current Information Security Management System. Preston has a proven track record building out Information Security Management Systems with Security Service Oriented Architectures (SSOA), enabling enhanced integration, automation, and simplified management. Before joining F5, he was Director of information Security at social media provider Demand Media where he built out the information security team. Preston’s career began 18 years ago when he served as a security analyst performing operational security (OPSEC) audits for the U.S. Air Force. He currently holds CISSP, CISA, CISM, and CRISC security and professional certifications.

Previous Columns by Preston Hogue:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/VIR2dEcNu-I/youre-opted-default-know-when-and-where-opt-out

With No Unifying U.S. Federal Privacy Law, States Are Implementing Their Own

Pending Privacy Bills Will Have Critics and Face Lobbying From Vested Interests

With Europe’s GDPR and the California Consumer Privacy Act (CCPA) as templates, and almost all large companies having to conform to one or both, it is little wonder that the U.S. is being forced to consider a unifying federal law on consumer privacy. But progress is slow — and even with the potential for a federal law to supersede state laws, the states are not waiting to implement their own.

Many of the new local privacy bills tend to focus on narrow aspects of privacy rather than attempt the wide-ranging privacy control of GDPR and CCPA. Eight are worth considering: New York City, New York State, North Carolina, Oregon, Utah, Virginia, Washington, and Wyoming.

New York City

New York City is focusing on biometric identification. It is described as ‘A Local Law to amend the administrative code of the city of New York, in relation to requiring businesses to notify customers of the use of biometric identifier technology”, and was introduced in October 2018.

The bill defines a biometric identifier as “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry, any of which is collected, retained, converted, stored or shared to identify an individual.” It requires all companies using such identifiers to display, both physically at an establishment entrance and online on a website, information on how long such data is retained, what biometric data is collected, retained, converted, or stores; details on any relevant privacy policy; and whether the data is shared with third-parties. Government agencies are excluded.

Official enforcement involves a fine of $500 for each day an organization is in violation. Private action is allowed, with damages of up to $1000 for negligent violation, and $5,000 for intentional or reckless violation — plus reasonable legal costs.

Noticeably, there is no restriction on organizations collecting and using biometric identification, nor any insistence that user consent is required. The theory is that if anybody objects, they can walk away.

New York State

On January 9, 2019, Sen. Brad Hoylman introduced ‘The Right to Know of 2019‘. Its purpose is described as amending “the general business law, in relation to restricting the disclosure of personal information by businesses. The purpose is to give consumers greater clarity over the collection and use of their personal data.

It would require businesses that retain personal user information to make details of what is held available on demand, together with details of any third-party with which the data is shared. Personal data is widely defined, including identity; address; phone; account name; SSN and other government-issued numbers; DoB, physical characteristics; sexual characteristics; racial, religious, political, professional, educational, medical, and commercial information; internet history; and content provided by the customer.

The bill is more limited in scope than the CCPA, but like the CCPA seems to be relevant to any company that does business within the state — regardless of their physical location.

North Carolina

North Carolina has not yet unveiled specific privacy legislation, but Attorney General Josh Stein and N.C. House Rep. Jason Saine have indicated an intention to do so. This is likely to focus on identity theft protection by strengthening existing breach notifications, and will potentially be called the “Strengthen North Carolina Identity Theft Protection Act”.

It will redefine what constitutes a ‘breach’ to include a ransomware attack. It will require companies to maintain “reasonable security procedures and practices”., and adds medical, genetic and health insurance details to the definition of protected information.

Most of the new proposals relate to a post-breach situation. Notification is to be as soon as possible, but no later than 30 days. People can place or lift a credit freeze on their credit report at any time to prevent stolen information being used to open any fraudulent credit lines. Victims must be given 2 years free credit monitoring (4 years if the breached company is a consumer reporting agency like Equifax).

Furthermore, companies seeking to obtain or use a person’s credit score will need to disclose the purpose of the request and gain the person’s permission. North Carolina citizens will be able to request all data held on them by a consumer reporting agency, details on how the data was obtained, and a list of any person or entity to which it was disclosed.

Oregon

More than 40 state legislators introduced the Health Information Property Act (PDF) in Oregon at the end of January. The purpose is to give citizens greater control over the use of their personal medical information by increasing the current protections afforded by HIPAA.

It states, ” A covered entity, business associate, subcontractor or other third party doing business in this state may not engage in the commercial sale of protected health information, health information or de-identified data without first obtaining a signed authorization from the individual.” It further states that no consumer may be penalized for refusing to sign an authorization, nor for accepting — if offered — payment to sign.

One of the chief sponsors, Rep. David Gomberg, commented, “Consumers are now realizing how little privacy we have and how often we sign it away. By treating personal data as property, legislators can empower individuals to better control information about themselves and how it is used by others.”

It is worth noting that all the pending privacy bills will have critics and face lobbying from vested interests. Adam Greene of the law firm David Wright Tremaine, has commented on this proposal that it “would reduce any of the useful research, public health and other benefits that are provided by de-identified information today, and would at the same time create privacy and security risks for individuals by forcing companies to retain a link between the de-identified data and an identifiable individual.”

Utah

Rep. Craig Hall introduced a new privacy bill (HB 57) at the beginning of the year. The purpose is to provide digital content privacy for digital communications — such as emails and instant messages. The creator of the content would be the presumed owner, and any third-party — such as government — that wanted access would require a warrant from a judge. “I want to make clear that the protections that we now have in the paper world are also in place for the electronic world,” said Hall.

Such a bill would undoubtedly attract the attention of the big tech giants. Google, for example, scans all emails sent via Gmail. Any provider of messaging services that do not provide end-to-end encryption would also be wary of the detail.

For the moment, they don’t need to worry. The other vested interest — government — has voiced its own concerns; and the bill has been paused. On January 31, it was decided to hold the bill following opposition from state and local prosecutors. Their view is that the bill would interfere with criminal investigations, possibly disrupt consumer-protection probes, and potentially cripple online child pornography investigations.

Virginia

On 18 January, Democrat Hala Ayala introduced HB 2793 requiring ‘care and disposal of customer records’. “A business,” it states, “shall take all reasonable steps to dispose of, or arrange for the disposal of, customer records within its custody or control containing personal information when the records are no longer to be retained by the business by shredding, erasing, or otherwise modifying the personal information in those records to make it unreadable or undecipherable through any means.”

The bill also imposes requirements on the manufacturers of ‘connected devices’. They must be equipped with reasonable security features designed to protect the device and any information it contains from unauthorized access, use or modification; and be in compliance with the best practices of OWASP and IoT Security Foundation guidelines for IoT devices.

If a manufacturer becomes aware of a vulnerability that puts more than 500 users at risk, it must be reported to the chief information officer of the Commonwealth of Virginia and remediation steps provided to consumers without unreasonable delay.

Washington

The Washington Privacy Act was introduced on January 18, 2019 (Senate Bill 5376) (PDF). This is more wide-ranging than the other pending state privacy bills, and bears similarities with both the CCPA and the GDPR. Like CCPA, it applies to organizations that conduct business within the state, or produce services targeted at residents of the state.

From GDPR it borrows the concept of data controller and data processor in order to delineate the different responsibilities toward personal data.

Consumers will have the right to access personal data being held, can demand its deletion if it is no longer required for the purpose it was collected, restrict its use for direct marketing, and know and object to it being sold to third parties.

It also addresses the use of facial recognition technologies. Consumer consent must be obtained by organizations that deploy facial recognition services. State and local government agencies are prohibited from using facial recognition for the surveillance of specific individuals in public places.

Although there is no right of private action under the bill, the Washington State Attorney General would enforce the bill with fines of up to $2,500 for each violation, or up to $7,500 for each intentional violation.

Wyoming

Finally, we have something a little different from Wyoming. SF0125 — Digital assets-existing law — was presented on 18 January 2019, has already been adopted, and is due to come into effect on 1 March. It ensures that cryptocurrencies can be recognized as real money.

The bill is for “classifying digital assets within existing laws; specifying that digital assets are property within the Uniform Commercial Code; authorizing security interests in digital assets; establishing an opt-in framework for banks to provide custodial services for digital asset property as directed custodians; specifying standards and procedures for custodial services under this act; clarifying the jurisdiction of Wyoming courts relating to digital assets; specifying applicability; authorizing the promulgation of rules.”

While this is not a privacy bill per se, it gives the citizens of Wyoming privacy over financial transactions to the extent provided by their cryptocurrency of choice.

Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.

Previous Columns by Kevin Townsend:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/ZHr2rWH6Eug/no-unifying-us-federal-privacy-law-states-are-implementing-their-own

Check-in Links Sent by Several Airlines Expose Passenger Data

The check-in links sent to customers by several major airlines from around the world can allow hackers to obtain passengers’ personal information and possibly make changes to their booking, mobile security firm Wandera warned on Wednesday.

Members of Wandera’s threat research team noticed in December that the links sent by Air France to customers through the company’s e-ticketing system are not protected by any type of encryption. These links are typically sent by companies via email or SMS and they are used to initiate the check-in process.

Further analysis revealed that similarly unprotected links were sent out by other major airlines as well, including Southwest in the US, KLM and Transavia in the Netherlands, Vueling and Air Europe in Spain, Jetstar in Australia, and Thomas Cook in the UK.

The problem is that the check-in links sent by these airlines to their customers initiate a connection over HTTP instead of HTTPS.

The link itself, as Wandera VP of Product Michael Covington told SecurityWeek, includes a record locator, the origin of the flight and its destination, and, in some cases, the passenger’s name. Airlines use this data to identify each passenger and provide access to details of their reservation.

Airlines send unencrypted check-in links

An attacker who can intercept a user’s traffic – for example, by compromising a public Wi-Fi connection – can leverage these credentials to gain access to the targeted user’s online check-in page.

Depending on the airline, the check-in service can provide access to data such as email address, name, gender, passport information, nationality, phone number, partial payment card information, booking reference, flight details (flight number, seating data), and even the complete boarding pass. In some cases, the attacker could also make changes to the data provided by the legitimate user.

“Boarding procedures vary from airport to airport and can be more or less secure. The most concerning aspect of this vulnerability is that in some cases a hacker or criminal can print a victim’s boarding pass and could even attempt to board a scheduled flight,” Wandera researchers explained.

The security firm pointed to a recent news report claiming that a man traveling from the UK to Poland boarded the wrong airplane and ended up in Malta. The incident raised concerns about boarding pass screening as the man had a ticket for Poland.

Wandera believes airlines should encrypt communications during the check-in process, they should implement additional authentication mechanisms for processes that involve access to personal information (especially if that information can be edited), and use one-time tokens for direct links delivered via email or SMS.

SecurityWeek has asked Wandera if it’s possible that a single e-ticketing platform is used by all the impacted airlines, but the security firm believes the weakness is not introduced by a single platform.

“Based on my assessment of the data and conversations I’ve had with the airlines, I’m fairly confident that this vulnerability impacts more than one platform,” Covington explained. “While a subset of the airlines may use a common platform, there are sufficient variations in how these systems communicate that I believe there to be several e-ticketing systems involved.”

“I suspect this boils down to an industry-wide decision to make online check-in easy; they’ve essentially prioritized usability over security. The entire problem goes away if they simply made the e-mail/SMS links one-time use,” he added.

Wandera notified each of the impacted airlines in December 2018 and January 2019, and said it had also shared its findings with government agencies in charge of airport security.

“Some have responded and indicated that they are investigating the issue,” Covington told SecurityWeek. “Unfortunately, we have not been able to verify that any fixes have been implemented. Our researchers have confirmed that some of the e-ticketing systems are still exposing data, so the problem has not been resolved.”

Other researchers revealed recently that a vulnerability affecting a reservation system provided by Spain-based Amadeus, which is used by hundreds of airlines worldwide, could have exposed the details of millions of passengers.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/EoTE4p17xps/check-links-sent-several-airlines-expose-passenger-data

Smart Watch Recalled in Europe Over Privacy Risks

The European Commission (EC) has ordered the recall of a children’s smart watch: the ENOX Safe-Kid-One, manufactured in Germany. It had received a complaint from Iceland’s consumer protection regulator.

The EC alert provides little detailed information, merely saying, “The mobile application accompanying the watch has unencrypted communications with its backend server and the server enables unauthenticated access to data. As a consequence, the data such as location history, phone numbers, serial number can easily be retrieved and changed.

A malicious user can send commands to any watch making it call another number of his choosing, can communicate with the child wearing the device or locate the child through GPS.”

Such potential is alarming under any circumstance, but particularly concerning where children are concerned.

According to the BBC, ENOX considers the recall to be ‘excessive’. The company’s founder, Ole Anton Bieltvedt said that the watch had passed tests carried out by German regulators last year allowing it to be sold. It has appealed the ruling. However, in November 2017, the German telecoms regulator banned the sale of smart watches to children, saying they violated Germany’s strict surveillance laws.

It had found the watches to be unauthorized transmitters capable of surreptitious child monitoring, and had even been used by parents to listen to teachers in the classroom.

“This is yet another example of IoT devices being rushed to market without proper consideration of privacy,” said Cesar Cerrudo, CTO at ethical hacking company, IOActive. “We are connecting more and more of these devices to the internet and manufacturers are really not applying due diligence, which in the long run will be really costly. While they may get the upper hand in beating the competition to get products to market, they lose out in the long run. Fines and the reputational damage — and in this case product recalls — can have a huge impact on revenues and consumer trust. Businesses need to build security in at the core of their solution, during the design phase, not as an after-thought.”

At the time of writing this, the Safe-Kid-One smart watch was still apparently available from several on-line distributors.

Previous Columns by Kevin Townsend:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/AL9PjvEdQ5Y/smart-watch-recalled-europe-over-privacy-risks

UK Data Watchdog Fines Leave.EU, Eldon Insurance

The UK data protection regulator (the Information Commissioner’s Office – ICO) launched a wide-ranging investigation into the use of personal information for political purposes following the Facebook/Cambridge Analytica affair. It resulted in the publication of a lengthy report titled ‘Democracy disrupted? Personal information and political influence’ in July 2018, and a fine on Facebook set at the maximum amount possible – £500,000 ($645,000).

In one sense, the Facebook fine was a side-effect. The ICO’s primary intention was to investigate the possible misuse of personal information by the Leave campaign ahead of the Brexit referendum within the UK. This investigation has continued. In November 2018, Information Commissioner Elizabeth Denham issued preliminary enforcement notices stating that it would fine the Leave.EU organization and Eldon Insurance a total of £135,000 ($176,000).

The action against Facebook was taken in relation to the Data Protection Act 1998, now replaced by the Data Protection Act 2018 (the UK’s implementation of GDPR). The action against Leave.EU and Eldon Insurance is under the Privacy and Electronic Communications Regulations 2003 (PECR), the laws which govern electronic marketing.

Since November, the ICO has heard representations from the two organizations, and has today (February 1, 2019) made its notices formal. It found that Leave.EU and Eldon Insurance were closely linked. Systems for segregating the personal data of insurance customers from that of political subscribers were ineffective. It is also worth noting that Eldon Insurance is controlled by Aaron Banks, who donated £8 million to the Leave campaign. Leave.EU and Eldon share the same corporate address, and there is a cross-over of staff between the two organizations. Banks is under separate investigation by the National Crime Agency over whether he was the true source of his donation.

In a series of formal notices published today, the ICO has issued three separate fines (totaling £15,000 less than the initial intention). Leave.EU has been fined £15,000 for using Eldon Insurance customer details unlawfully to send almost 300,000 political marketing messages. Eldon Insurance has been fined £60,000, and Leave.EU a further £45,000, for two direct marketing campaigns that sent over one million emails to Leave.EU subscribers without sufficient consent.

The ICO has also announced its intention to audit both organizations. “It is deeply concerning that sensitive personal data gathered for political purposes was later used for insurance purposes; and vice versa. It should never have happened,” announced Denham. “We have been told both organisations have made improvements and learned from these events. But the ICO will now audit the organisations to determine how they are using customers’ personal information.”

These audit assessment notices give the ICO access to Leave.EU and Eldon’s joint offices, staff, and documentation. It is a criminal offence to obstruct an ICO audit or destroy information covered by it.

In its announcement, the ICO says, “The ICO’s audit team will be looking at data protection practices including observing how personal data is processed, considering what policies and procedures are in place and looking at the types of training made available for staff. They will also be interviewing key employees across both organisations including the directors, staff and their data protection officers. The ICO’s audit findings will be made public at the conclusion of its work.”

So, while the current notices have been issued under PECR, the ICO is now going to examine internal practices in relation to the Data Processing Act (GDPR). The earlier fine it levied against Canadian firm AggregateIQ (AIQ) shows that the pre-GDPR date of the incidents in question (Facebook/Cambridge Analytica for AIQ, and the Brexit referendum for Leave.EU and Eldon) will be overridden by any post-GDPR continuation of bad practices.

It is not necessarily all over yet for Leave.EU and Eldon Insurance.

Previous Columns by Kevin Townsend:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/bqU7WPzXNp0/uk-data-watchdog-fines-leaveeu-eldon-insurance

Apple Partially Fixes FaceTime Spying Bug

Apple reported on Friday that the FaceTime spying bug that has been making headlines in the past days has been partially fixed, but users will have to wait until next week for a software update.

According to Apple, a server-side patch has been implemented, but the application update that re-enables the Group FaceTime feature will only be rolled out next week. The company initially promised to patch the flaw this week.

The security bug allows an attacker to spy on FaceTime users through their microphone and camera simply by calling the targeted user and adding the attacker’s own number to a group chat. While the hacker can hear and, in some cases, see the victim, on the victim’s side it appears as if the call still hasn’t been answered. Apple fixes FaceTime bug

Apple suspended the Group FaceTime feature after the bug became widely known, but it may have already been too late. A lawyer from Texas has filed a lawsuit against the tech giant, claiming that the vulnerability was exploited to record a client’s private deposition.

The flaw was discovered by Grant Thompson, a 14-year-old from Arizona, who, with the help of his mother, attempted to report the issue to Apple more than 10 days before its existence became public. They claimed that their attempts to inform the company were ignored.

In its latest statement, Apple has thanked the Thompson family for reporting the bug and it has promised to improve the process for receiving and escalating these types of reports to ensure that they get to the right people faster.

“We sincerely apologize to our customers who were affected and all who were concerned about this security issue. We appreciate everyone’s patience as we complete this process,” Apple stated.

“We want to assure our customers that as soon as our engineering team became aware of the details necessary to reproduce the bug, they quickly disabled Group FaceTime and began work on the fix,” it added.

This bug has caused a lot of problems for Apple. In addition to bad PR and a lawsuit, it also triggered an investigation in New York. The New York attorney general and governor announced a probe into the company’s failure to warn customers and its relatively slow response.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/Securityweek/~3/qnsw8LJuLlc/apple-partially-fixes-facetime-spying-bug