Author: admin

Poor cyber-hygiene to blame for many compromises

Blend of phone and face-to-face fraud targets vulnerable

What’s better? Disclose early, patch fast? Or dig deep, disclose in full, patch more slowly?

The U.S. Department of Justice indites middle-aged doctor, accusing him of being a malware mastermind.

Research indicates that organizations should make patching existing flaws a priority to mitigate risk of compromise.

Researchers say a GitHub proof-of-concept exploitation of recently announced VMware bugs is being abused by hackers in the wild.

Researchers have demonstrated iPhone malware that works even when the phone is fully shut down.

t turns out that the iPhone’s Bluetooth chip­ — which is key to making features like Find My work­ — has no mechanism for digitally signing or even encrypting the firmware it runs. Academics at Germany’s Technical University of Darmstadt figured out how to exploit this lack of hardening to run malicious firmware that allows the attacker to track the phone’s location or run new features when the device is turned off.

[…]

The research is the first — or at least among the first — to study the risk posed by chips running in low-power mode. Not to be confused with iOS’s low-power mode for conserving battery life, the low-power mode (LPM) in this research allows chips responsible for near-field communication, ultra wideband, and Bluetooth to run in a special mode that can remain on for 24 hours after a device is turned off.

The research is fascinating, but the attack isn’t really feasible. It requires a jailbroken phone, which is hard to pull off in an adversarial setting.

Slashdot thread.

Molding and shaping our kids while we can is every parent’s dream. When kids are young – and sweet! – they are far more inclined to take on board our advice and lovingly imposed rules. Oh, how I miss those days!! And in a nutshell – that’s what a good set of parental controls can do for you and your kids. In my opinion, parental controls can absolutely help you create good habits but it’s essential that they are accompanied by an invested parent who’s keen to help their kids navigate the online world. 

What Can Parental Controls Do? 

With Aussie kids spending at least 5 hours online a day, it’s no secret that they can be exposed to a broad range of people, websites and themes – some potentially quite disturbing. And with most kids sporting an internet-connected phone plus a laptop, there’s no limit to what they can access – and usually when you aren’t around. 

I like to think of parental controls as another way of helping establish healthy habits and good decision-making strategies with your kids. For example, if you have told your kids there is no screen time before bed, then you are able to use Parental Controls to make that a reality. And if you have agreed that they are able to use only certain apps or social media platforms then Parental Controls can also make this happen by blocking access if they deviate. I believe that over time, these routines, and boundaries simply become part of your child’s day-to-day life and become good habits. 

McAfee’s Parental Controls, called Safe Family, can also let you view your kids’ activity online and let you know where your kids are at all times. How good??    

Doesn’t It Take Just 21 Days To Form A Habit? 

While it’s commonly believed that it takes just 21 days to form a habit, courtesy of Dr Maxwell Maltz in the 1960’s, more up-to-date research shows that it could take considerably longer. In fact, research conducted in 2010 by Health Psychology Researcher Philippa Lally at The University College in London shows that it takes around 2 months or 66 days to be precise to make a new habit stick! 

And while I love the idea that we could help our kids adopt new positive habits in just 2 months, I think we need to keep it real. Fear of missing out (FOMO) coupled with the lure of their shiny devices might mean that it takes a little more than 66 days to make a change, particularly if you are trying to modify their current usage as opposed to starting from scratch. 

Nothing Replaces The Role Of Being A Proactive Digital Parenting 

There is no-one that better understands just how time poor parents can be. Having spent the last 20 plus years rearing 4 boys and working, I feel like I’ve earnt the time poor t-shirt! So, understandably, many parents feel like they just don’t have the ‘band with’ to take on much more so digital parenting is often put in the too hard basket. And I totally get it!    

But using parental controls without some knowledge of your kids’ digital world, is a little like filling your car with petrol but not worrying about the oil. It will eventually be a problem! 

My Top 3 Digital Parenting Non-Negotiables 

So, I’m going to break it down for you. Digital parenting doesn’t have to be overwhelming, particularly if you break it down. So, in a quest to keep it simple, here are 4 things you can do to up your digital parenting game: 

1. As Soon as Your Kids Start Using Devices, Start Talking Cybersafety 

The day your child picks up a device is the day you start talking about cybersafety. If this is when they are 18 months of age, then that’s when you start. Always ensure the messages are age-appropriate and keep them simple. You could start with:  

• “Remember, daddy/mummy chooses the game” 
• “Let’s keep your name private online.” To help with this, why not create an online nickname for them? 
• “Make sure you’re sitting near (mum/dad/nana) when you are using the iPad.” 

And when your kids get older, weave in more age-appropriate messages, such as: 

• “Online friends aren’t real friends” 
• “If you wouldn’t do it in person then don’t do it online” 
• “Think before you post” 

Knitting cybersafety messages into your family dialogue needs to also become automatic. Talk about it just like you would sun safety or road safety. And why not share stories around the dinner table about your own online experiences or even relevant news stories to engage them in a dialogue. 

2. Create a Family Digital Contract 

I love the idea of a clear contract between parents and kids that details your expectations about their online behaviour and technology use. It’s a great way of developing a set of guidelines that will help them navigate the risks associated with being online. Now, this agreement should definitely be a family exercise so ensure your kids are invested in the process too. If you want a starting point, check out this one from The Modern Parent here.  

3. Commit to Understanding Your Child’s Digital World 

Taking some time to understand how your child spends their time online is the best way of truly understanding the risks and challenges they face. So, join ALL the social media platforms your kids are on, play their games and download their messaging apps. You will develop a better understanding of how to manage privacy settings and the language/online culture that is a big part of your child’s life. And the best part – if they know you understand their world, I have no doubt that you will develop a little ‘tech cred’ which mean that they will be more likely to come to you with any issues or problems that may face online. Awesome! 

Get Technology Working for You 

There is some amazing technology available that makes this digital parenting thing a heck of a lot easier and that includes Parental Controls. McAfee’s Safe Family is a comprehensive parental controls solution that lets you monitor and block apps and websites, manage screen time, see where your kid’s devices are at all times, and more, giving you peace of mind in an ever-mobile world. The perfect partner to an invested parent! 

Parental Controls can be an awesome way of helping your kids establish positive habits around their tech use, but they are even more impactful when combined with an invested parent who has got a good handle on the online world. So, by all means, invest in Parental Control software but also commit to ramping up your digital parenting game – it’s the best way to help set up your kids for a safe and positive experience online. And isn’t that every digital parent’s dream! 

Take Care 

Alex  

The post Can Parental Controls Can Help You Create Good Habits? appeared first on McAfee Blog.

Some of more tech-savvy Democrats in the U.S. Senate are asking the Federal Trade Commission (FTC) to investigate identity-proofing company ID.me for “deceptive statements” the company and its founder allegedly made over how they handle facial recognition data collected on behalf of the Internal Revenue Service, which until recently required anyone seeking a new IRS account online to provide a live video selfie to ID.me.

In a letter to FTC Chair Lina Khan, the Senators charge that ID.me’s CEO Blake Hall has offered conflicting statements about how his company uses the facial scan data it collects on behalf of the federal government and many states that use the ID proofing technology to screen applicants for unemployment insurance.

The lawmakers say that in public statements and blog posts, ID.me has frequently emphasized the difference between two types of facial recognition: One-to-one, and one-to-many. In the one-to-one approach, a live video selfie is compared to the image on a driver’s license, for example. One-to-many facial recognition involves comparing a face against a database of other faces to find any potential matches.

Americans have particular reason to be concerned about the difference between these two types of facial recognition, says the letter to the FTC, signed by Sens. Cory Booker (D-N.J.), Edward Markey (D-Mass.), Alex Padilla (D-Calif.), and Ron Wyden (D-Ore.):

“While one-to-one recognition involves a one-time comparison of two images in order to confirm an applicant’s identity, the use of one-to-many recognition means that millions of innocent people will have their photographs endlessly queried as part of a digital ‘line up.’ Not only does this violate individuals’ privacy, but the inevitable false matches associated with one-to-many recognition can result in applicants being wrongly denied desperately-needed services for weeks or even months as they try to get their case reviewed.”

“This risk is especially acute for people of color: NIST’s Facial Recognition Vendor Test found that many facial recognition algorithms have rates of false matches that are as much as 100 times higher for individuals from countries in West Africa, East Africa and East Asia than for individuals from Eastern European countries. This means Black and Asian Americans could be disproportionately likely to be denied benefits due to a false match in a one-to-many facial recognition system.”

The lawmakers say that throughout the latter half of 2021, ID.me published statements and blog posts stating it did not use one-to-many facial recognition and that the approach was “problematic” and “tied to surveillance operations.” But several days after a Jan. 16, 2022 post here about the IRS’s new facial ID requirement went viral and prompted a public backlash, Hall acknowledged in a LinkedIn posting that ID.me does use one-to-many facial recognition.

“Within days, the company edited the numerous blog posts and white papers on its website that previously stated the company did not use one-to-many to reflect the truth,” the letter alleges. “According to media reports, the company’s decision to correct its prior misleading statements came after mounting internal pressure from its employees.”

Cyberscoop’s Tonya Riley published excerpts from internal ID.me employee Slack messages wherein some expressed dread and unease with the company’s equivocation on its use of one-to-many facial recognition.

In February, the IRS announced it would no longer require facial scans or other biometric data from taxpayers seeking to create an account at the agency’s website. The agency also pledged that any biometric data shared with ID.me would be permanently deleted.

But the IRS still requires new account applicants to sign up with either ID.me or Login.gov, a single sign-on solution already used to access 200 websites run by 28 federal agencies. It also still offers the option of providing a live selfie for verification purposes, although the IRS says this data will be deleted automatically.

Asked to respond to concerns raised in the letter from Senate lawmakers, ID.me instead touted its successes in stopping fraud.

“Five state workforce agencies have publicly credited ID.me with helping to prevent $238 billion dollars in fraud,” the statement reads. “Conditions were so bad during the pandemic that the deputy assistant director of the FBI called the fraud ‘an economic attack on the United States.’ ID.me played a critical role in stopping that attack in more than 20 states where the service was rapidly adopted for its equally important ability to increase equity and verify individuals left behind by traditional options. We look forward to cooperating with all relevant government bodies to clear up any misunderstandings.”

As Cyberscoop reported on Apr. 14, the House Oversight and Reform Committee last month began an investigation into ID.me’s practices, with committee chairwoman Carolyn Maloney (D-N.Y.) saying the committee’s questions to the company would help shape policy on how the government wields facial recognition technology.

A copy of the letter the senators sent to the FTC is here (PDF).

Ransomware impacted certain internal systems