Gregarius » BetaNews.Com » février 18, 2016

BetaNews.Com (24 non lus)

Gozi Banking Trojan is now fully compatible with the Edge browser in Windows 10

Publié: février 18, 2016, 11:18pm CET par Alan Buckingham

Malware spy

Banking trojans, like ransomware, have become big business today. And the people behind all of these malicious products are always moving forward, innovating with the times in an effort to keep up with technology and victims.

There is a virtual smorgasbord of malware out there just looking for ripe pickings. One is the Gozi Banking Trojan, which injects its code into the operating system via the browser. With Windows 10 being offered (pushed) for free, malware makers are scrambling to cover the adoption rate by updating their products.

One is the Gozi Banking Trojan which has just received an update to make it friendly with both Windows 10 and its new Edge browser. Given that most users opt for the default browser in Microsoft's operating system, this makes perfect sense.

Researchers at the X-Lab at IBM found that "the malware’s developer has found a new way to use the same overall code injection mechanism on the Win10 Edge browser as it did on previous Windows OS versions. The code behind this new capability can now be injected into the MicrosoftEdgeCP.exe process, which is the Edge browser’s process".

Essentially this attacks explorer.exe and its child processes, each of which is altered to maintain the infection. This can result in keylogging ability among other nasty things you don't want on your PC. Now things have changed slightly.

That wasn't entirely possible with Edge so the programmers came up with a new method of attack. "Gozi needed a new workaround for Windows 10. Its developer began by going to the new parent process and leveraging another process: RuntimeBroker.exe. The latter is the parent process of the Edge browser in Windows 10 machines", states researcher Or Safran. "According to the research of Gozi’s new capability, the malware’s developer has found a new way to use the same overall code injection mechanism on the Win10 Edge browser as it did on previous Windows OS versions. The code behind this new capability can now be injected into the MicrosoftEdgeCP.exe process, which is the Edge browser’s process".

The Gozi Baking Trojan was first detected back in 2007, making it one of oldest in the business. Parts of its code have since been used in other malicious software. Security researchers will continue to monitor this latest iteration of Gozi and attempt keep users one step ahead.

Photo Credit: Balefire / Shutterstock

Microsoft wants to make Windows 10 and Office 365 more accessible

Publié: février 18, 2016, 10:40pm CET par Mark Wilson

black_microsoft_logo

Making its products accessible to as many people as possible is clearly in Microsoft's best interests. Today the company outlined how it plans to improve accessibility in Windows 10 and Office 365, setting out a roadmap built on three key principles.

Transparency, accountability and being inclusive will be the company's cornerstones for 2016. Microsoft wants to "to think about all of our customers and all of the ways we can empower them with technology". But what does this actually mean.

Listening to and responding to feedback is at the heart of the new Microsoft, and have been central to the development of Windows 10. Accessibility is nothing new -- options have existed in Microsoft software for decades now -- but there is still more that can be done. Looking at Windows 10 in particular Chief Accessibility Officer Jenny Lay-Flurrie says:

Improve commonly used features and do a great job with showcase Windows experiences. We are working to ensure that everyone can easily access and use the Start menu, the lock screen, and settings as well as Cortana, Store, Music, Videos and more.
We’re also working hard on our new browser, Microsoft Edge. By the end of 2016, the browser will have improved browsing and reading experiences not just for those using our built-in assistive technologies, such as Narrator and Magnifier, but also for people who use other commercial assistive technology. On Feb. 3, we shared our priorities for 2016, including additional detail about the key areas that we think will have the biggest impact.
Windows 10 Mail will have improved screen-reader support for common email scenarios – already, we’ve made progress against these goals on Mail for PCs.
Work continues to improve our built-in assistive technology by increasing performance, reliability, compatibility and usability. These improvements translate to a faster Narrator, improved compatibility while using apps like Windows 10 Mail and Microsoft Word, better mapping of keyboard commands to user expectations and an increase in the number of supported languages.

Microsoft has similar goals for Office 365:

Making it easier to author accessible content from any device. In 2016, we will be extending the Accessibility Checker (already available in Office for PCs) to Office for Mac and improving the experience with alt-text in Office Online.
Making it easier to use Office 365 with screen readers and keyboards on any device. Last year, we added support for VoiceOver for Office for Mac and this year, we will be adding full accessibility support for all our Windows 10 store apps.
Enhancing the experience with our apps in High Contrast Mode. For example, we will make it easy to read commands and navigate through controls in Office for PC.
Introducing new reading and writing tools that are particularly beneficial for people with dyslexia. In January, we introduced a preview of Learning Tools in OneNote for PC that will be generally available in 2016. We are also working on improving spelling checker in Word 2016 and Outlook 2016 to offer suggestions for phonetic and other less commons misspellings.
Enabling everyone to use our applications in more intuitive ways. We introduced "Tell Me what you want to do..." in Office Online and Office 2016 for PCs to help people get things done quickly or get help by entering intuitive commands. We will be extending this capability to Office on iOS and Android in 2016.

Photo credit: 360b / Shutterstock.com

Apple says sorry for iPhone Error 53 and issues iOS 9.2.1 update to fix it

Publié: février 18, 2016, 9:36pm CET par Mark Wilson

restore_iphone_6

Apple has a lot of support at the moment for its stance on encryption and refusing the FBI access to an iPhone's contents, but it's only a couple of weeks since the company was seen in a less favorable light. There was quite a backlash when users found that installing an update to iOS resulted in Error 53 and a bricked iPhone.

Apple initially said that Error 53 was caused 'for security reasons' following speculation that it was a bid to stop people from using third party repair shops. iFixit suggested that the problem was a result of a failure of parts to correctly sync, and Apple has been rounding criticized for failing to come up with a fix. Today the company has issued an apology, along with an update that ensures Error 53 won't happen again. But there's more good news.

If you were talked into paying for an out of warranty replacement as a result of Error 53, you could be in line to get your money back. Apple says that the error came about because a test feature was accidentally made public -- it was an update that was never meant to reach customers.

Apple's full statement reads:

Some customers’ devices are showing 'Connect to iTunes' after attempting an iOS update or a restore from iTunes on a Mac or PC. This reports as an Error 53 in iTunes and appears when a device fails a security test. This test was designed to check whether Touch ID works properly before the device leaves the factory.

Today, Apple released a software update that allows customers who have encountered this error message to successfully restore their device using iTunes on a Mac or PC.

We apologize for any inconvenience, this was designed to be a factory test and was not intended to affect customers. Customers who paid for an out-of-warranty replacement of their device based on this issue should contact AppleCare about a reimbursement.

Photo credit: Attila Fodemesi / Shutterstock

Automation will take away more than 100,000 jobs within 20 years in the UK

Publié: février 18, 2016, 9:34pm CET par Sead Fadilpašić

Fujitsu and Microsoft announce IoT and M2M partnership

You shouldn’t fear immigrants taking your job, you should fear robots. A new study by jobs search engine Adzuna suggests that more than 100,000 of current job vacancies will be fully automated within the next 20 years.

The results are based on the study of Oxford University researchers, looking at which jobs would basically be given to robots before 2035.

Adzuna looked at 1.2 million job adverts across the country, and came to the conclusion that almost 10 percent (1 in 11 vacancies) have more than 75 percent chance to be given to robots.

Machine operators and plant managers are most at risk, together with admin and secretarial roles.

Looking at where you’d want to live in the next 20 years, London seems to be the best place, while you’d want to get away from Exeter, Norwich and Plymouth. Researchers believe almost nine percent of all ads for jobs in the Devon city will be given to robots. In London, Reading and Edinburgh, 1 in 20 vacancies could face a similar fate.

"We’ve heard that more than a third of current British jobs may be lost to automation, but our new analysis of the job market suggests that a high proportion of advertised vacancies are still for roles that are at high risk of being performed by robots in the not too distant future", said Adzuna co-founder Doug Monro.

"The risk of a robot invasion on the Devon coast might sound fanciful, but there’s a serious message for younger workers, whether they’re looking for their first job, or are comfortably in a career: if you want to remain relevant in the workplace, you need to develop skills that cannot be easily automated".

Adzuna Jobs Robots Automatization

Photo credit: bogdanhoda / Shutterstock

Samsung bringing Gear S2 classic 3G/4G smartwatch to Verizon, AT&T, and T-Mobile

Publié: février 18, 2016, 9:21pm CET par Brian Fagioli

Gear_S2_classic_black_-_connected

Modern smartwatches are hardly must-have devices. Most are simply extensions of smartphones, serving as nothing more than expensive accessories. In other words, many smartwatches aren't very useful on their own.

Some of these watches, however, have cellular radios, making them useful as a standalone experience. Heck, they could even replace smartphones for those with limited needs. Today, Samsung announces that it is bringing its standalone-ready Gear S2 classic 3G/4G smartwatch to Verizon, AT&T, and T-Mobile.

"Beginning Friday, March 11, the Samsung Gear S2 classic 3G/4G (black) will be available on select major wireless networks. Utilizing connected functionality consumers will have the ability to call, text, email and receive notifications directly from their watch, even without their phone. The Gear S2 classic 3G/4G features a fashionable leather band and a unique rotating-bezel design -- giving consumers a quick, precise way to navigate through their notifications, apps and widgets", says Samsung.

The famed company further says,"the Gear S2 classic 3G/4G will be available at AT&T, T-Mobile and Verizon. Wireless providers will confirm pricing and availability. The addition of the 3G/4G connected Gear S2 classic models provides users with an even wider choice of award-winning Samsung smartwatches".

Gear S2 classic 3G/4G Product Specifications:
Display	1.2”, Circular Super AMOLED, 360x360, 302ppi
AP	Dual core 1.0 GHz
OS	Tizen based wearable platform
Audio	Codec: MP3/AAC/AAC+/eAAC+ Format: MP3, M4A, AAC, OGG
Memory	Storage: 4GB Internal Memory / RAM: 512MB
Features	Communications: Contacts, Notifications, Messages, Email, Preset text, Voice Input, Emoticons, Keypads
Health & Fitness: S Health, Nike+ Running
Information: Schedule, News, Maps & Navigation, Weather
Media: Music Player, Gallery
Others: Voice, Voice Memo, Find My Device, Power Saving Mode, Safety assistance, Privacy lock
IP68 Certified Dust and Water Resistant
Samsung Services	Samsung Gear Apps
Connectivity	Wi-Fi: 802.11 b/g/n/e Bluetooth 4.1 NFC 3G/4G Connected
Sensor	Accelerometer, Gyroscope, Heart Rate, Ambient Light, Barometer
Dimension	44.0 x 46.9 x 13.4 (54g)
Battery	Wireless Charging 300mAh Li-ion Typical Usage 2~3days

If you are a hardcore smartphone user, a connected smartwatch probably won't be replacing your Android or iPhone anytime soon. So who is this for? I could see this being a smart buy for older children, as parents can use it to keep in touch. It is also a great choice for people that can't carry a bulky smartphone, such as runners or bicyclists. The Gear S2 classic 3G/4G would be used in place of the smartphone, which could be left safely at home.

If you are interested in buying this stylish and powerful connected smartwatch, you do not need to wait long. You can head to a local Verizon, AT&T, or T-Mobile store on March 11 and snag one. Don't like leaving the house? It should be available online too. Pricing will vary based on provider and contract options.

The majority of IT pros view email as a major security threat

Publié: février 18, 2016, 9:17pm CET par Sam Pudwell

Sixty-five percent of IT professionals don’t feel equipped to defend against email-based cyber attacks, according to the findings of a report carried out by email security and archiving company Mimecast.

The global study of 600 IT security professionals -- Mimecast Business Email Threat Report 2016, Email Security Uncovered -- also found that 64 percent of respondents regard email as a major security threat and one third believe email is more vulnerable today than it was five years ago.

"Our cyber-security is under attack and we depend on technology, and email in particular, in all aspects of business. So it’s very disconcerting to see that while we might appreciate the danger, many companies are still taking too few measures to defend themselves against email-based threats in particular", said Peter Bauer, chief executive officer, Mimecast.

"As the cyber threat becomes more grave, email attacks will only become more common and more damaging. It’s essential that executives, the C-suite in particular, realize that they may not be as safe as they think and take action. Our research shows there is work still to be done to be safe and we can learn a lot from the experience of those that have learnt the hard way", adds Bauer.

Mimecast categorized respondents into five distinct "personas" based on their perceptions of data breach confidence. They are: The Vigilant, Equipped Veterans, Apprehensive, Nervous and Battle-Scarred. The breakdown and explanations are shown in the image below.

mimecast-shiver-grid

The biggest gaps between the most and least prepared respondents were found in budgets and C-suite involvement. Out of the IT security manager polled, only 15 percent say their C-suite is extremely engaged in email security, while 44 percent say their C-suite is only somewhat engaged, not very engaged, or not engaged at all.

Unsurprisingly, those respondents that felt more prepared have larger budgets allocated to email security. Specifically, 50 percent more than IT managers who were less confident in their readiness to defend against an attack.

Photo credit: Pavel Ignatov/ Shutterstock

Windows 10 Insider Preview Redstone Build 14267 arrives on the Fast ring -- and brings welcome improvements

Publié: février 18, 2016, 7:53pm CET par Wayne Williams

Windows 10

After a flurry of new builds, Insiders on the Fast ring have had to wait a whole two weeks for the latest Windows 10 update to arrive.

Unlike previous Fast ring releases, which focused on updates to OneCore (the core that Windows 10 shares across devices) and preparing the ground work for future additions, like extensions, Build 14267 actually has some improvements worthy of note, including several usability enhancements to Microsoft Edge.

We’ll get to Microsoft’s browser in just a second, but first there’s a tweak to Cortana which is worth a mention. The software giant’s personal assistant is able to identify and search for music you’re playing (a bit like Shazam), and in the new build you can now add a music search icon to the top right of Cortana that will allow you to quickly start her listening.

There are Messaging + Skype improvements in the new build as well. You can now easily attach photos to new Skype messages as you compose them, and take and attach photos using the Camera app.

As for the Edge improvements, there are three: Right-clicking the Favorites bar now lets you choose to just show favicons, or add new folders; download prompts will allow you to choose where to save a file; and Edge can now automatically clear browsing data when you close it. Setting Edge to clear this data is done by clicking the three dots at the top right, going into Settings, and clicking the 'Choose what to clear' button under ‘'Clear browser data'.

There have been a handful of fixes made in this new build too. Microsoft lists the following:

Choosing "Reset This PC" under Settings > Update & Security > Recovery should now work as expected.
You should no longer see a WSClient.dll error dialog after logging in.
The front-facing camera should be usable again on PCs with Intel RealSense cameras and you should be able to use Windows Hello again.
Fixed an issue where incorrect storage capacity was provided for the system volume (the hard drive in which Windows is installed on) under Settings > System > Storage.

Fast ring releases usually have a whole bunch of known issues to be aware of, but this time there’s just the one:

If you’re using Hyper-V and upgrade to this build with more than one vswitch or have multiple virtual networking adapters (including legacy), you may lose networking connectivity after upgrade.

Fortunately Microsoft has a solution:

To get network connectivity back, there are two workarounds available:

Remove all the virtual network adapters connected to the vswitch, delete the vswitch and recreate it, then reconnect their virtual NIC to the new vswitch.

Admin command prompt, do "netcfg -d" will wipe-out all the vswitch settings so that you can start from scratch.

Photo credit: charnsitr / Shutterstock

Prelert brings behavioral analytics to Elasticsearch

Publié: février 18, 2016, 5:39pm CET par Ian Barker

Data analytics

Increased use of big data in IT management and other areas means that companies are on the look out for new tools to give them better insights from their information.

Behavioral analytics company Prelert is making it easier for Elasticsearch users to automate the analysis of large data sets with the launch of Behavioral Analytics for the Elastic Stack.

It's powered by Prelert's machine learning algorithms and capabilities, which have been proven in the company’s other analytics products including its widely deployed Anomaly Detective solution. Prelert’s analytics create accurate, always up-to-date statistical baselines of normal behaviors. From these baselines the software is able to detect, score and link unusual activity that could indicate IT operations problems, IT security incidents, or business interruptions.

Since the automated analysis flags real issues as they're happening, it eliminates the need for traditional data monitoring rules and thresholds that return false positives if set too strictly, miss activity if set too loosely, and become outdated over time. Prelert's analytics include new statistical influencer tracking, which provides contextual data for each detected anomaly, so the root cause of issues can be identified and resolved quickly.

"There's a whole new world of possibilities for the way users extract value from their data that’s being driven by combining the power of analytics with the speed of search," says Tanya Bragin, Director of Product Management at Elastic. "Prelert's automated behavioral analytics are a powerful addition to the Elastic Stack and further demonstrates how developers can build an application using Kibana’s UI framework".

Behavioral Analytics for the Elastic Stack is expected to be available for download next month but in the meantime you can get more information on the Prelert website.

Photo Credit: Sergey Nivens / Shutterstock

IBM introduces Blockchain-as-a-service

Publié: février 18, 2016, 5:38pm CET par Sead Fadilpašić

IBM is looking to move blockchain technology beyond Bitcoin and money transfer as it announced Blockchain-as-a-service on Tuesday.

Blockchain-as-a-service allows developers to "create digital assets and accompanying business logic to more securely and privately transfer assets among members of a permissioned blockchain test network".

The best part of it all is that it’s free -- 44,000 lines of code are available on GitHub to developers everywhere. Blockchain technology is an online public ledger where you can log pretty much any kind of transaction. Being decentralized, and allowing all parties to double-check the transfers, in theory it could reduce errors or misuse.

"London Stock Exchange Group is directly engaged in the development of the open blockchain technologies with IBM and we are excited to help enable the creation of solutions that will help manage risk and bring additional transparency to global financial markets", said Moiz Kohari, EVP, group head of technology innovation, London Stock Exchange Group. "We believe this technology has the potential to drive change across the industry but will need to be developed in partnership with customers and industry participants under an open source approach".

In order to speed things up, IBM has opened up what it calls IBM Garages -- places where developers and IBM experts can collaborate on the design and implementation of blockchain for business. The IBM Garages will open up in London, New York, Singapore and Tokyo.

"In just a few short months, IBM’s vision for making blockchain a powerful new business solution across multiple industries is becoming a reality as our clients begin piloting innovative new code, services and z Systems optimized for distributed ledgers", said Arvind Krishna, Senior Vice President, IBM Research. "These advancements are making it easier for developers to move from understanding the potential of blockchain, to actually using it to change their business processes in powerful new ways".

Tomasz Bidermann/Shutterstock

Vertafore and Microsoft launch first custom CRM solution for the insurance industry

Publié: février 18, 2016, 4:39pm CET par Ian Barker

CRM

CRM systems have become essential tools for sales and marketing teams, giving them the ability to organize and automate the processes that build good customer relationships.

But off-the-shelf solutions don't always meet the needs of specialist industries. Insurance technology specialist Vertafore is launching its new Agency SalesTrack solution, built on Microsoft Dynamics CRM to cater specifically for the insurance sector.

"Built on Dynamics CRM, Vertafore's Agency SalesTrack solution addresses the key challenges insurance agents face today," says Tom Feher, US Financial Services Industry Director at Microsoft Corporation. "Working with the rich features and capabilities of Dynamics CRM, Vertafore's SalesTrack Solution provides a 360 view of their production pipeline as well as the details needed to service clients. This increases agent productivity by eliminating duplicate data entry, enabling agents to not only meet their sales quota, but also provide exemplary service to their clients".

SalesTrack integrates with Vertafore's existing AMS 360 product to to centralize customer information and increase visibility into the key performance indicators affecting insurance sales. It offers a comprehensive view of the entire customer journey, eliminating the need for duplicate data entry and the associated delays and errors.

"We evaluated the major software providers in the CRM space, and we are really excited to partner with Microsoft Dynamics," says Greg Wright, SVP, Agency and Carrier Solutions at Vertafore. "Together, we're developing solutions for the independent insurance channel at incredible speed. The launch of Vertafore Agency SalesTrack helps independent agencies adapt and meet the evolving need of consumers and the insured so producers can focus on what they do best: selling insurance".

For more information on Agency SalesTrack and to register for a webinar explaining how it works you can visit the Vertafore website.

Photo Credit: Mikko Lemola / Shutterstock

Apple's new Trade Up With Installments program aims to lure Android users to iPhone

Publié: février 18, 2016, 4:38pm CET par Mark Wilson

iphone_in_hand

Apple has launched a new program called Trade Up With Installments which makes it possible to upgrade to the latest iPhone in a more affordable way. As the name suggests, this is more than a straight trade-in program -- upgraders can use the trade-in value of their old handset to reduce on-going monthly costs.

This is something that will appeal not only to people with older iPhones who are looking to get their hands on a newer model, but also ex-Android fans -- Apple is opening up the program so Android handsets can be traded in and their value offset against the cost of a new iPhone. Windows Phone handsets are also eligible.

Trade Up With Installments is slightly different to the existing iPhone Upgrade Program and trade-in option. After handing over your old handset -- be it iOS, Windows Phone or Android powered -- for part exchange for a new iPhone, you'll then (assuming you qualify) be extended credit and allowed to pay off the remaining balance over 24 months.

At the moment, Trade Up With Installments is only available in the US, and can only be accessed through Apple Stores. The program starts today, and is likely to prove popular not only because it is can be used by Android handset owners, but also because there is no commitment to getting a new iPhone every year.

Speaking to CNET, Apple said that the new program is aimed at people who have older iPhones. But taking into account the fact that iPhone growth slowed surprisingly it is understandable that it has been opened up to include other handsets. Launching Trade Up With Installments at the beginning of the year makes sense, as it gives plenty of time for it to get established and for word to spread ahead of the expected launch of the iPhone 7 later in the year.

Photo credit: Twin Design / Shutterstock

Lien pour 'BetaNews.Com/2016/02/18/Cloud_storage_providers_could_be_breaching_the_Consumer_Rights%e2%80%99_Act'

Cloud storage providers could be breaching the Consumer Rights’ Act

Publié: février 18, 2016, 4:21pm CET par Secure Data MGT

Warning Sign Sky Cloud Cloudy

The Competition and Markets Authority (CMA) is to launch an investigation into whether cloud storage users are paying the right amount for their data storage service amidst concerns that cloud providers are hiking prices and are locking customers into pricey contracts.

The issue has arisen at a time when cloud storage is becoming ever more popular with consumers and businesses. The Office for National Statistics has estimated that 40 percent of UK adults now use cloud storage. Consumers often chose to store their photos and music on the cloud whilst businesses frequently depend on cloud application services, including as Software as a Service (SaaS) and Platform as a Service (PaaS).

Over the past few years companies have begun to pass up external hard drives in favor of the cloud. The cloud facilitates work remotely by enabling employees to access data on the go.

Most leading cloud storage providers give their customers a certain amount of storage space for free, after which they charge prices which rarely exceed £40 a month. Some businesses and consumers have started to complain about these fees, stating that cloud providers have been unexpectedly increasing their monthly prices. In a recent customer survey Secure Data MGT found that 63 percent of IT managers feel they are provided inadequate cloud storage space for their needs.

The CMA is encouraging businesses and consumers with complaints about their cloud provider to come forward. It may be ruled that the actions of cloud storage providers are in violation of the Consumers Rights' Act. The Act was passed only in October this year. It gives consumers longer periods in which they could refund purchases. The act also protects consumers who shop online. For instance, if a customer makes a digital film purchase but is unable to play it they can get a substitute under this new legislation.

The CMA has said it is also looking into what happens to consumers' information once they have stopped using a cloud storage service, amid security concerns. It will investigate how this information is destroyed and if it is destroyed securely. The CMA will try to determine how transparent cloud providers are and whether their users are being given sufficient information before beginning contracts.

Cloud storage providers have in the past given false assurances to consumers. The pledge to provide unlimited storage to customers is frequently recanted by nervous cloud vendors. Providers often offer unlimited storage to customers without actually considering how much storage space businesses and individuals now require. Vendors quickly begin to realize that the cost of providing customers unlimited storage is simply not sustainable. This has been the case with smaller companies, such as Mozy and Hive.

Even tech giants have had to back-track on their unlimited storage commitments. Just over a year ago Microsoft announced that it would provide unlimited storage, otherwise known as its' OneDrive service, to those signed up to its Office 365 Home and Personal program. Last month Microsoft put an end to this deal, stating that some customers were using up too much of their supposedly 'unlimited storage'. The amount of storage available has been capped to 1TB. Some customers complained that even before Microsoft announced these changes they had found their storage space was being reduced.

When it comes to data storage, consumers and businesses are becoming more equipped at identifying loopholes. The Consumer Act has emboldened consumers who have felt misguided by their cloud storage providers and has encouraged them put forward their complaints. Increasingly, cloud users are able to understand exactly what they want from their provider; with data security, sufficient storage space and fair costing all ranking high in their list of priorities.

Cloud providers that do not live up to customers' expectations and adequately fulfill their priorities should expect a swift reprisal. They cannot hide behind tech jargon any longer.

Photo Credit: bahri altay/Shutterstock

Secure Data MGT are UK specialists in offsite information backup for physical records and digital media.

95 percent of US consumers share their passwords

Publié: février 18, 2016, 4:06pm CET par Ian Barker

123456_password_sticky_note

It seems that convenience trumps security when it comes to passwords. Although 73 percent of US consumers believe sharing login details is risky, 95 percent do share between one and six of their passwords with other people.

A new survey by LastPass also reveals that only 19 percent of respondents say they don't share passwords that would jeopardize their identity or financial information, leaving a scary 81 percent of people who would share them.

The study explored the password sharing habits of more than 1,000 US consumers of 18 or older. Among the key findings were that 59 percent use the same password on multiple sites, which means people are potentially exposing more online accounts than they realize through password sharing.

"Nearly all aspects of our lives have some online component and when you bring password sharing into the mix, all of that sensitive information is instantly compromised," says Joe Siegrist, VP and GM of LastPass. "We realize that at times, people and teams need access to the same accounts, so we created a new LastPass Sharing Center in our 4.0 version, allowing users to easily and securely share their passwords, giving them the peace of mind knowing their passwords are protected".

Other findings include that only 27 percent of respondents reset a password after sharing it with others. Younger generations are more trusting too, those aged 18-29 are the most likely to share passwords with friends. In fact, 40 percent said they’d shared a password with a friend as opposed to 15 percent of those aged 30-44, only 6 percent aged 45-59 and 8 percent aged 60+.

Password sharing isn't limited to personal accounts either. One in four respondents admit to sharing business passwords, classified as any password associated with their workplace. Additionally, 61 percent of respondents say they are more likely to share their work passwords than personal passwords.

You can find more details of the survey's findings in the infographic below.

Sharing_Survey_Infographic

Photo credit: shutteratakan / Shutterstock

Windows clone ReactOS hits version 0.4.0

Publié: février 18, 2016, 4:04pm CET par Mike Williams

ReactOS-768x546

It’s been ten long years since the last major release, but open source Windows clone ReactOS is still very much alive, and the latest release shows just what’s been achieved since 2006.

There’s finally support for NTFS read and ext2 read/ write, out of the box.

Hardware improvements include SATA support, a working USB stack, and -- gasp -- sound.

Networking has also come a long way, with wireless networking and SSL support.

A new shell adds a lot of functionality, and should be much more reliable.

There’s also some 3D graphic support, the ability to properly load graphics drivers, an updated memory manager, a much more compatible Registry implementation, and -- maybe most useful of all -- an NT Virtual DOS Machine (NTVDM) for running 16-bit DOS applications, including old games.

Does it work? Well, we grabbed an installation CD, and had ReactOS running under VirtualBox within minutes, no hassles at all.

If you’ve not tried ReactOS before, the Applications Manager is a major plus, enabling a host of popular packages to be downloaded and installed immediately: Firefox, Opera, OpenOffice, GIMP, VLC Media Player, IrfanView, various torrent clients, VNC tools and a whole lot more.

We double-clicked Firefox and watched as it was downloaded and automatically installed: neat.

But then, when we started using Firefox, problems quickly appeared, with the browser window not always rendering correctly. Maybe it was something specific to us, our settings, graphics driver, or VirtualBox, but most people won’t want to spend an age trying to find out.

Overall, ReactOS is still very much an alpha release, and not for most users. If you just want a free operating system that’s easy to use, try Linux Mint. The interface is familiar and with Wine installed, you’ll be able to run quite a few Windows applications.

But if you’re a Windows geek, understand the technical challenges here, maybe have an ancient laptop you’d like to revive or some legacy programs to revisit, ReactOS offers plenty to explore.

Are you Digitally Enlightened or an Online Nudist?

Publié: février 18, 2016, 3:51pm CET par Ian Barker

personal-keyboard

According to the results of a new survey, while two thirds of US respondents say they would like extra layers of online privacy and security, their actions prove otherwise as few even use currently available tools.

The study by VPN provider Hide My Ass! has been used to categorize people into five different approaches to online life:

* Old School Sharers are hesitant to share personal information or participate regularly on social media and lack confidence that they are protected from threats.

* Cautious Contributors are apprehensive about new technology, but are more socially inclined and learn from the mistakes of the past.

* Online Nudists seek out and bare everything to their online community, craving a high amount of interaction with their peers through social media.

* Social Savvy Butterflies are active in and seek interaction from online communities, but have stepped up their game and take precautions to ensure their personal information stays safe.

* The Digitally Enlightened employ the highest levels of security, which enables them to safely maintain their highly active digital lives.

Among the survey's findings are that 63 percent of respondents have experienced online security issues, but, of those, only 56 percent have made permanent behavior changes afterwards. Nearly one in four people (24 percent) use unsecured public Wi-Fi, leaving their information open to prying eyes, quite often or all the time.

Take up of existing security tools is depressingly low, only 16 percent utilize privacy-enhancing browser plug-ins, just 13 percent use two-factor authentication and a mere 11 percent use a VPN. In fact 44 percent are not at all familiar with VPNs and a mere four percent use anonymity software (such as Tor).

While 70 percent say that the risk of exposing personal information online reduces their level of social media use and presence, only a quarter have strict privacy restrictions in place on their social media accounts. Also while two thirds say they are likely to shred physical documents containing personal information they are happy to post details online including their email addresses (51 percent), home addresses (26 percent) and personal phone numbers (21 percent).

"Even with the NSA revelations and a seemingly endless onslaught of celebrity hacks and public data breaches, Americans still turn a blind eye to their vulnerability online," says Danvers Baillieu, the chief operating officer of Hide My Ass! "While many people say they want to protect themselves online, it is difficult for them to sacrifice things like their level of social presence. For too many, the gratification of a ‘like’ severely outweighs the investment in building a digitally secure life. When it comes to choosing either security or convenience, the latter almost always wins".

You can find a summary of the findings in infographic form below.

HMA privacy infographic

strong>Image Credit: jurgenfr / Shutterstock

New research suggests alarm system SimpliSafe simply isn't safe

Publié: février 18, 2016, 3:47pm CET par Alan Buckingham

sniffer

If you watch TV at all, at least in the US, you've likely seen the ads for the latest technologies being pushed to market. While many folks like to be early adopters, there's something to be said for ignoring that pie-in-the-sky pitch and waiting until something has had time on the market and been thoroughly tested.

We recently saw this with the Ring doorbell, a product that continues to run endless TV commercials, perhaps just banking on appealing to the average person who doesn't look into things too carefully. Another one taking up your screen time these days is a new alarm system calling itself SimpliSafe. The problem is, research indicates it may not be living up to its impressive moniker.

Andrew Zonenberg at IOActive reports that, from its testing of the SimpliSafe system, there are some problems, and they are not minor.

There is some background information on how the system works, but the main components are the keypad and the base unit, which communicate in the 433 MHz and 315 MHz range.

Once there was some understanding of how the system works, based on dismantling several units, Zonenberg states "Rather than waste time setting up an SDR or building custom hardware to mess with the radio protocol, I decided to 'cheat' and use the conveniently placed test points found on all of the boards. Among other things, the test points provided easy access to the raw baseband data between the MCU and RF upconverter circuit".

From there the research went on saying "To implement the actual attack I simply disconnected the MCUs from the base station and keypad, and soldered wires from the TX and RX basebands to a random microcontroller board I had sitting around the lab. A few hundred lines of C later, I had a device that would passively listen to incoming 433 MHz radio traffic until it saw a SimpliSafe 'PIN entered' packet, which it recorded in RAM. It then lit up an LED to indicate that a PIN had been recorded and was ready to play back. I could then press a button at any point and play back the same packet to disarm the targeted alarm system".

The snooping system could be created for a one-time $250 investment in the necessary hardware. It was then just a matter of hiding the device somewhere within 100 feet of the targeted home and waiting for the PIN to be transmitted. Then the bad guy is in and the device can move on to the next location.

Perhaps the worst part is that there is no fix, as Zonenberg states, "the keypad happily sends unencrypted PINs out to anyone listening". This can be fixed in future products, but current customers are out of luck as the microcontrollers are one-time programmable, so all current systems will need to be replaced. IOActive contacted the manufacturer but received no response.

IT professionals' bad security habits exposed

Publié: février 18, 2016, 3:17pm CET par Ian Barker

security padlock

Many IT personnel don't follow the same security protocols they’re expected to enforce according to the results of a new survey of over 500 professionals working in IT security roles.

The study by Absolute Software Corporation shows that 45 percent of IT professionals admitted to knowingly circumventing their own organization's security policies. In addition 33 percent of respondents admitted to successfully hacking their own or another organization.

"Given that IT is the security gatekeeper for an organization, it was alarming to see such high incidents of non-compliant behavior by IT personnel," says Stephen Midgley, vice president, Global Marketing at Absolute. "Even if these actions are being performed to validate existing infrastructure, senior leadership should be aware that this activity is occurring. It may also be worthwhile to consider third-party audits to ensure adherence with corporate security policies".

Security remains at the top of the IT spending list, with 87 percent of respondents expecting increased investment in security this year. Despite prioritizing security and increasing budgets, IT departments believe that employees represent the greatest security risk to an organization (46 percent). This may be related to the fact that on average, 33 percent of all security protocols are not being followed by staff. It may also explain the high incidents of security breaches, with 38 percent of respondents experiencing a data breach within the past year.

Younger professionals are also likely to show a more casual attitude to security according to the findings. Among IT professionals aged 18-44, 41 percent are likely to hack their own organization compared to just 12 percent of those in the 45+ age group. 92 percent of 18-44 year-olds say they are confident in containing a data breach, compared to 79 percent of 45+ professionals.

"Despite marked improvements, businesses are still very susceptible to attack," adds Midgley. "The gaps in current data breach response plans and in upholding general best practice policies must be addressed".

The full report is is available to download from the Absolute website.

Photo Credit: Alexander Kirch/Shutterstock

Microsoft offers Red Hat Enterprise Linux in Azure Marketplace

Publié: février 18, 2016, 2:50pm CET par Mihăiță Bamburic

Red Hat Enterprise Linux Microsoft Azure Marketplace

Azure already supports a number of major Linux distributions, like CentOS and openSUSE, but Microsoft is now taking things one step further by offering Red Hat Enterprise Linux instances through the cloud platform's Marketplace.

This comes as a direct result of Microsoft's partnership with Red Hat, which, among other things, is meant to "help customers embrace hybrid cloud computing by providing greater choice and flexibility deploying Red Hat solutions" on the software giant's cloud platform.

The versions of the Linux distribution that are offered through Azure's Marketplace are Red Hat Enterprise Linux 6.7 and Red Hat Enterprise Linux 7.2. Both are available in all regions with the exception of China and US government, according to Microsoft's announcement.

Microsoft makes it clear that users who wish to take advantage of either of the two Red Hat Enterprise Linux instances will have to pay a separate hourly charge, on top of what they already pay for Azure. The pricing information can be found here.

"Red Hat and Microsoft have worked together to ensure Red Hat subscriptions purchased through the Azure Marketplace provide unique, integrated subscription support and value through direct access to the Red Hat customer portal. This provides you the full breadth of Red Hat enterprise value delivered directly as part of the Azure on-demand experience", Microsoft says.

In addition, Microsoft has also started to certify a number of Linux images that have been created by Bitnami for the cloud platform's Marketplace. Users can expect to see "many" images being certified over the coming months; you can check Bitnami's virtual machine offerings here.

Microsoft has also announced the general availability of Azure Container Service, which has been developed in partnership with Docker and Mesosphere.

As Microsoft puts it, Azure Container Service "makes it easy to create and manage clusters of Azure Virtual Machines pre-configured with key open source components". Interested users can try it here.

Linux was not meant to be open source

Publié: février 18, 2016, 1:32pm CET par Mark Wilson

linux_penguin_with_book

The Linux community has a lot to shout about. In addition to a seemingly endless choice of distros to suit every taste and need, there's also the highly-prized security. This is helped to a large extent by the open source nature of Linux, but Linus Torvalds has revealed that being open source was not part of the original plan.

Torvalds made the revelation in a rare interview at the TED conference in Vancouver saying that Linux started off as a personal project that he intended to keep to himself. The computing landscape certainly would have panned out into something very different to that which we see today had he not made that crucial decision.

In the interview, Torvalds said: "I did not start Linux as a collaborative project, I started it for myself. I needed the end result but I also enjoyed programming. I made it publicly available but I had no intention to use the open-source methodology, I just wanted to have comments on the work".

He said that he came to understand the value of having input from other people, particularly because of his inability to design a user interface. "If I was stranded on a desert island and the only way to get off was to create a pretty UI I would die there," he said.

It should come as no surprise that Torvalds describes himself as a nerd. Speaking to TED curator Chris Anderson, he said that he is not a 'people person'. He understood the need to involve 'people people' who were able to do things that he could not.

I am not a visionary. I'm an engineer. I'm happy with the people who are wandering around looking at the stars but I am looking at the ground and I want to fix the pothole before I fall in.

Photo credit: Julien Tromeur / Shutterstock

Microsoft's Surface Book goes on sale in the UK

Publié: février 18, 2016, 11:00am CET par Wayne Williams

Surface-Book-Image-9

Surface Book, Microsoft’s hybrid laptop/tablet combo, officially launches in the UK from today.

If you're not familiar with it, the device has a detachable screen, a hinge that divides opinion (some people think it looks great, others hate it), and enough power to suit most users’ needs. It has a 13.5-inch PixelSense touchscreen display with a 3:2 aspect ratio that makes it great for getting "real work" done.

If you're thinking of buying one, be warned it’s a little pricey. The base model, with a Core i5 processor, is priced at £1,299, while the top of the line model, which boasts a Core i7 processor and a dedicated NVIDIA GeForce GPU, will set you back an even more wallet-worrying £2,249.

Surface Book is available to buy today through Microsoft's online store and various other popular retailers, including Amazon, John Lewis and Currys PC World.

Cisco announces Firepower Next-Generation Firewall

Publié: février 18, 2016, 9:47am CET par Sead Fadilpašić

Cisco

Cisco has released a new firewall solution which aims to completely change how security services tackle cyber-threats.

The new product, Cisco Firepower Next-Generation Firewall (NGFW), is built to detect threats on a system, and not keep the system on a lockdown. Here’s how Cisco explains the new product

"Think of it as legacy NGFWs protecting 'homes' by securing windows and doors, whereas Cisco’s approach is to identify, detect and protect against would-be burglars no matter how they try to gain access to a property", Cisco says NGFW is the first product in the industry to link contextual information about the usage of apps with threat intelligence.

To complement the firewall, the company has also unveiled the new Cisco Firepower 4100 Series appliances, for high-performing business apps. These dense, compact units are capable of 40GbE network connectivity. They will be managed through the Cisco Firepower Management Center, also a new Cisco product. The Center will serve as a 'nerve center', providing a rich, unified management console.

"Attackers are getting bolder and coordinating their efforts. The industrialization of hacking is putting businesses on the defensive against a growing group of adversaries that steal information for profit", said David Goeckeler, senior vice president and general manager at Security Business Group, Cisco.

"In the last three years, Cisco has spent billions in strategic cybersecurity acquisitions and internal innovations to help stay ahead of the world’s most malicious attacks that threaten organizations. For businesses to get real value and manage risk as they implement digital operational models, their security platforms need to integrate into the business and support growth opportunities. This means taking a threat-centric approach, with protection from the mobile endpoint to the cloud", added Goeckeler.

Image Credit: Katherine Welles / Shutterstock

Scan your PC for unsigned files with SigcheckGUI

Publié: février 18, 2016, 9:01am CET par Mike Williams

SigCheckGUI

Your PC is misbehaving. Is it malware? Faulty software, maybe? Scanning for PC for digitally signed files can help to pick out trustworthy executables, and highlight unsigned files for more investigation.

Sysinternals’ Sigcheck provides a vast amount of information and options, but it’s also a console tool, maybe inconvenient if you don’t use it enough to learn the various switches.

SigcheckGUI is a portable free alternative, a front-end for Sigcheck which allows you to set it up in a few clicks, and adds a few bonus features as well.

You’ll probably start by choosing your scan targets. These can be specific files, the contents of a folder tree, or all running processes.

(Scanning can take a very long time -- tens of minutes -- so we’d recommend starting with a test folder to assess the speed, before pointing the program at \Windows.)

SigcheckGUI doesn’t check VirusTotal by default, for performance reasons. If that’s a problem, click the Options tab and check "Query VirusTotal" to turn the feature on.

Whatever you choose is scanned, and details are displayed about each file: whether it’s signed or unsigned, the signing date, publisher, description, product name, product/ file/ binary version, whether it’s 32 or 64-bit, its original name, internal name, copyright, comments, hashes, path, and -- optionally -- VirusTotal score.

Unsigned files are highlighted in red, making them easy to spot. This doesn’t mean they’re dangerous -- even SigcheckGUI.exe is unsigned, ironically -- but you’ll at least get some ideas about what to check next.

Right-clicking any file displays options to help you investigate further. You’re able to open the file location, run web searches, open a VirusTotal URL for the file, and more.

SigcheckGUI’s interface isn’t great, and we noticed one or two minor bugs in our tests (right-clicking a file and selecting Open File Location didn’t always work).

The program carries out its main tasks without difficulty, though, and overall it can be a useful way to find malicious or unwanted software.

SigcheckGUI is a free application for Windows XP and later.

Linksys EA7500 MAX-STREAM AC1900 MU-MIMO 802.11ac gigabit router now available

Publié: février 18, 2016, 5:58am CET par Brian Fagioli

linksys-li-EA7500-1

When friends or family ask me to help with their Wi-Fi woes, I often discover the same thing -- low-cost and aging routers. Understandably, people are always looking to save a buck, but a router is not the place to do so. A quality router is worth the money -- dropped connections and necessary reboots are a scourge.

Today, Linksys announces that its EA7500 MAX-STREAM AC1900 MU-MIMO 802.11ac gigabit router is available for pre-order. Not only is it fast and chock-full of features, but it is reasonably priced too.

"The new Linksys AC1900 MU-MIMO router leverages the 802.11ac Wave 2 MU-MIMO (Multi-User, Multiple Input, Multiple Output) technology, which helps ensure uninterrupted Wi-Fi connectivity to multiple devices in the home and functions as if multiple devices have their own dedicated router. With MU-MIMO, the whole household can enjoy 4K and HD TV streaming to multiple devices as well as play video games, listen to music, check email, shop, and more – all at the same time", says Linksys.

Justin Doucette, director product management, Linksys expains, "if you have or are planning to purchase a 4K TV you will need a Max-Stream router to ensure you have a seamless 4K online streaming experience. A single stream of 4K content takes a minimum of 20 Mbps to maintain a consistent stream, and when you combine that with multiple streams plus normal Wi-Fi use from gaming, internet surfing, IoT connectivity and music streaming, it adds up fast. Max-Stream will enable multiple streams of Wi-Fi to occur so users can have the ultimate 4K and networking experience".

linksysacmimo Linksys shares the following features.

Next-Gen AC Wi-Fi – 802.11ac Wave 2 with MU-MIMO Technology for uninterrupted Wi-Fi connections to multiple devices at the same time

Qualcomm IPQ 1.4GHz Dual Core Processor

Dual-band AC1900 Wireless speeds up to 1300 Mbps 5 GHz + 600 Mbps 2.4GHz, which is a combined speed up to 1.9 Gbps

Four Gigabit LAN Ethernet ports One Gigabit WAN for wired speeds up to 10x faster than fast Ethernet

One USB 3.0 and One USB 2.0 ports for connecting printers, storage and more

Three external and adjustable antennas for maximum coverage

Manage and monitor your network and easily control Wi-Fi devices remotely on a smart phone with the Linksys Smart Wi-Fi app

Advanced WPA/WPA2 encryption and SPI firewall helps keep the network safe

linksysacmimoac02 How much does this super-cool router cost? A rather reasonable $199. If you are used to purchasing budget routers, this price may seem high, but when it comes to networking, you get what you pay for. Sure, you can sometimes score a reliable router with discounted pricing, but Linksys, and parent company Belkin, are known for quality -- this should offer a solid experience.

If you are interested in buying it or learning more, you can can check it out here.

New drivers and firmware fix Surface Pro 4 and Surface Book power management problems

Publié: février 18, 2016, 1:17am CET par Mark Wilson

surface_book_folded

Both the Surface Pro 4 and Surface Book have been well-received devices on the whole, but there have been complaints from some users about power management. A failure to properly enter sleep mode has been causing not only battery drain, but also heat issues -- now Microsoft have issued fixes.

Starting today, new drivers and firmware updates are rolling out that address these problems as Microsoft says it continues to listen to user feedback.

Over on the Windows blog, Panos Panay writes: "Today's updates include a set of Microsoft and Intel driver and firmware updates for Surface Book and Surface Pro 4 that will help you get the most of the power management options that Surface is designed to offer and continue to make your Surface more productive".

On the Surface Book and Surface Pro 4 update pages, Microsoft reveals exactly what the updates include:

System Hardware Update -- 2/17/2016
Microsoft driver update for Surface UEFI
Microsoft driver update for Surface Management Engine
Microsoft driver update for Surface System Aggregator Firmware
Surface Management Engine update (v11.0.0.1202) improves system stability.
Surface System Aggregator Firmware update (v88.1081.257.0) improves accuracy of battery status and battery life during sleep.
Surface UEFI update (v104.1085.768.0) improves battery life and improves stability during power state transition changes into and out of sleep states.
Intel Precise Touch Device driver update (v1.1.0.226) improves stability during power state transition changes into and out of sleep states.
Intel HD Graphics 520 driver update (v20.19.15.4364) improves display stability, system stability and battery life.
Intel Display Audio driver update (v8.20.0.745) supports compatibility with the updated graphics driver.
Realtek High Definition Audio(SST) driver update (v6.0.1.7734) improves system stability.
Intel Smart Sound Technology (Intel SST) Audio Controller driver update (v8.20.0.866) improves system stability.
Intel Smart Sound Technology (Intel SST) OED driver update (v8.20.0.866) improves system stability.
Intel Management Engine Interface driver update (v11.0.0.1176) improves system stability.
Intel Serial IO GPIO Host Controller driver update (v30.63.1603.5) improves auto rotation reliability when tablet mode is turned off.
Intel Serial IO I2C Host Controller driver update (v30.63.1603.5) improves auto rotation reliability when tablet mode is turned off.
Surface Book Base Firmware driver update (v1.2.0.0) improves battery life during sleep.

If you have Automatic Updates installed, there's nothing to do other than sit back and wait for the updates to arrive. But if you've disabled this setting, now is the time to perform a manual check.