Independent – Page 74 – PossibleThreat Articles

How and why you need HomeKit-secured smart homes

February 27, 2020 0 Comments Apple, Home Tech, iOS, Mobile, Security

Credit to Author: Jonny Evans| Date: Thu, 27 Feb 2020 04:40:00 -0800

Once upon a time the Internet was amazing, enabling niche interests and connecting people. Apple’s iMac was the epitome of the era, while the iPhone became the prophet of change.

What is HomeKit-secured and why should you use it?

These days hackers break into home networks using our routers and smart home devices, which is why everyone must learn how to use HomeKit-secured routers to keep their connected homes safe.

Apple announced HomeKit-secured routers at WWDC 2019. The first few devices to support the tech recently began to reach market, including options from Linksys and (now) Amazon’s Eero routers.

To read this article in full, please click here

ComputerWorld Independent

Firefox starts switching on DNS-over-HTTPS to encrypt lookups, stymie tracking

February 26, 2020 0 Comments Browsers, Security

Credit to Author: Gregg Keizer| Date: Wed, 26 Feb 2020 11:11:00 -0800

Mozilla has started to turn on DNS-over-HTTPS, or DoH, as part of its overall strategy of stressing user privacy.

“We know that unencrypted DNS is not only vulnerable to spying but is being exploited,” wrote Selena Deckelmann, Mozilla’s new vice president of desktop Firefox, in a Feb. 25 post to a company blog. “We are helping…to make the shift to more secure alternatives [and] do this by performing DNS lookups in an encrypted HTTPS connection. This helps hide your browsing history from attackers on the network, helps prevent data collection by third parties on the network that ties your computer to websites you visit.”

To read this article in full, please click here

ComputerWorld Independent

Microsoft Patch Alert: February 2020 patches bring fire and ice but seem to have settled – finally.

February 26, 2020 0 Comments Microsoft, Microsoft Office, PCs, Security, Windows

Credit to Author: Woody Leonhard| Date: Wed, 26 Feb 2020 09:44:00 -0800

The real stinker this month, KB 4524244, rolled out the automatic update chute for four full days until Microsoft yanked it – leaving a trail of wounded PCs, primarily HP machines, in its wake. The other big-time bug in this month’s patches, a race condition in the KB 4532693 Win10 version 1903 and 1909 cumulative update installer, hasn’t been officially acknowledged by Microsoft outside of a blog post. But at least it’s well known and understood.

Folks running SQL Server and Exchange Server networks need to get patched right away.

Win10 UEFI update KB 4524244 blockages

Patch Tuesday brought KB 4524244 for Windows 10 owners, a bizarre single-purpose patch apparently directed at one specific UEFI bootloader. I talked about it last week.

To read this article in full, please click here

Independent Krebs Security

Zyxel 0day Affects its Firewall Products, Too

February 26, 2020 0 Comments 0day, alex holden, Latest Warnings, Time to Patch, zero day, zyxel

Credit to Author: BrianKrebs| Date: Wed, 26 Feb 2020 14:43:31 +0000

On Monday, networking hardware maker Zyxel released security updates to plug a critical security hole in its network attached storage (NAS) devices that is being actively exploited by crooks who specialize in deploying ransomware. Today, Zyxel acknowledged the same flaw is present in many of its firewall products.

ComputerWorld Independent

10 steps to smarter Google account security

February 26, 2020 0 Comments Google, productivity software, Security

Credit to Author: JR Raphael| Date: Wed, 26 Feb 2020 03:00:00 -0800

There are important accounts to secure, and then there are important accounts to secure. Your Google account falls into that second category, maybe even with a couple of asterisks and some neon orange highlighting added in for good measure.

I mean, really: When you stop and think about how much stuff is associated with that single sign-in — your email, your documents, your photos, your files, your search history, maybe even your contacts, text messages, and location history, if you use Android — saying it’s a “sensitive account” seems like an understatement. Whether you’re using Google for business, personal purposes, or some combination of the two, you want to do everything you possibly can to keep all of that information locked down and completely under your control.

To read this article in full, please click here

ComputerWorld Independent

How to fight scripting attacks

February 26, 2020 0 Comments Security

Most phishing campaigns use links to malicious scripts that infect users’ devices. Here’s how to spot and prevent them from doing damage.

ComputerWorld Independent

Top secret

February 25, 2020 0 Comments Security, Software

Credit to Author: Sharky| Date: Tue, 25 Feb 2020 03:00:00 -0800

It’s back when 5-inch floppy disks roamed the Earth, and a customer service tech sends a software update to a customer known to be a bit more than a little computer-challenged, says a pilot fish in the know. This involves physically mailing a stack of disks to the customer, along with a note saying to call the tech when she’s ready to install the update.

When the call comes, the tech is prepared to walk her through the installation step by step. After getting the computer booted up and verifying that the user has located disk No. 1, the tech says, “Insert the floppy disk into the disk drive, with the label facing up.”

Customer: “Done.”

Tech: “Type ‘A,’ and press the Enter key.”

To read this article in full, please click here

Independent Krebs Security

Zyxel Fixes 0day in Network Storage Devices

February 24, 2020 0 Comments 0day, 500mhz, alex holden, cert coordination center, cert/cc, cve-2020-9054, dhs, emotet, Hold Security, Latest Warnings, Ransomware, The Coming Storm, Time to Patch, zero day, zyxel communications corp.

Credit to Author: BrianKrebs| Date: Mon, 24 Feb 2020 17:13:11 +0000

Networking hardware vendor Zyxel today released an update to fix a critical flaw in many of its network attached storage (NAS) devices that can be used to remotely commandeer them. The patch comes 12 days after KrebsOnSecurity alerted the company that precise instructions for exploiting the vulnerability were being sold for $20,000 in the cybercrime underground. Based in Taiwan, Zyxel Communications Corp. (a.k.a “ZyXEL”) is a maker of networking devices, including Wi-Fi routers, NAS products and hardware firewalls. The company has roughly 1,500 employees and boasts some 100 million devices deployed worldwide. While in many respects the class of vulnerability addressed in this story is depressingly common among Internet of Things (IoT) devices, the flaw is notable because it has attracted the interest of groups specializing in deploying ransomware at scale.

ComputerWorld Independent

Why every user needs a smart speaker security policy

February 24, 2020 0 Comments Apple, Home Tech, iOS, Security

Credit to Author: Jonny Evans| Date: Mon, 24 Feb 2020 06:06:00 -0800

Does your voice assistant wake up randomly when you are engaged in normal conversation, listening to radio, or watching TV? You’re not alone, and this may have serious implications in enterprise security policy.

All things being equal (they’re not)

“Anyone who has used voice assistants knows that they accidentally wake up and record when the ‘wake word’ isn’t spoken – for example, ‘seriously’ sounds like the wake word ‘Siri’ and often causes Apple’s Siri-enabled devices to start listening,” the Smart Speakers research study says.

To read this article in full, please click here

ComputerWorld Independent

Apple joins industry effort to eliminate passwords

February 21, 2020 0 Comments Apple, iOS, Macs, Mobile, Security, smartphones

Credit to Author: Lucas Mearian| Date: Fri, 21 Feb 2020 03:00:00 -0800

In a somewhat unusual move for Apple, the company has joined the Fast IDentity Online (FIDO) Alliance, an authentication standards group dedicated to replacing passwords with another, faster and more secure method for logging into online services and apps.

Apple is among the last tech bigwigs to join FIDO, whose members now include Amazon, Facebook, Google, Intel, Microsoft, RSA, Samsung, Qualcomm and VMware. The group also boasts more than a dozen financial service firms such as American Express, ING, Mastercard, PayPal, Visa and Wells Fargo.

“Apple is not usually up front in joining new organizations and often waits to see if they gain enough traction before joining in. This is fairly atypical for them,” said Jack Gold, president and principal analyst at J. Gold Associates. “Apple is often trying to present [its] own proposed industry standards for wide adoption, but is generally not an early adopter of true multi-vendor industry standards.

To read this article in full, please click here