Latest Security News
The ATM card is dead. Or is it?
Starting Monday, all 13,000 Wells Fargo ATMs will enable you to withdraw money without using your card, according to Jonathan Velline, head of Wells Fargo ATM and branch strategy.
It works like this: Open the Wells Fargo app on your phone. Tap a button in the app for a temporary eight-digit code. Then enter the code, followed by your PIN, to access your account.
Wells Fargo is the first major U.S. bank to offer app-based access to all of its ATMs.
Citigroup, Chase and Bank of America and others are working on similar ATM functions, with only some machines already upgraded.Wells Fargo
Wells Fargo will enable ATM access without a card via a temporary eight-digit code accessible in its mobile app.
The Mac and iPhone exploits described in new documents attributed to the CIA were patched years ago, according to Apple.
WikiLeaks released a new set of files Thursday that supposedly came from the CIA. They contain details about the agency’s alleged malware and attack capabilities against iPhones and Mac computers.
The documents, dated 2012 and earlier, describe several “implants” that the CIA can install in the low-level extensible firmware interface (EFI) of Mac laptop and desktop computers. These EFI rootkits allow the agency's macOS spying malware to persist even after the OS is reinstalled.
What’s the best way to avoid Android malware? Downloading all your apps from the Google Play store -- where software is vetted – is perhaps the best advice.
But that doesn’t mean Google Play is perfect.
Security researchers do find new Android malware lurking on Google’s official app store. That’s because hackers are coming up with sneaky ways to infiltrate the platform, despite the vetting processes that protect it.
"Eventually, every wall can be breached," said Daniel Padon, a researcher at mobile security provider Check Point.
To be sure, most Android users will probably never encounter malware on the Google Play store. Last year, the amount of malicious software that reached the platform amounted to only 0.16 percent of all apps, according to a new report from Google.
Google is considering a harsh punishment for repeated incidents in which Symantec or its certificate resellers improperly issued SSL certificates. A proposed plan is to force the company to replace all of its customers’ certificates and to stop recognizing the extended validation (EV) status of those that have it.
According to a Netcraft survey from 2015, Symantec is responsible for about one in every three SSL certificates used on the web, making it the largest commercial certificate issuer in the world. As a result of acquisitions over the years the company now controls the root certificates of several formerly standalone certificate authorities including VeriSign, GeoTrust, Thawte and RapidSSL.
FBI director James Comey has suggested that an international agreement between governments could ease fears about IT products with government-mandated backdoors, but privacy advocates are doubtful.
Speaking on Thursday, Comey suggested that the U.S. might work with other countries on a “framework” for creating legal access to encrypted tech devices.
“I could imagine a community of nations committed to the rule of law developing a set of norms, a framework, for when government access is appropriate,” he said on Thursday.
Comey made his comments at the University of Texas at Austin, when trying to address a key concern facing U.S. tech firms in the encryption debate: the fear that providing government access to their products might dampen their business abroad.
A group of hackers threatening to wipe data from Apple devices attached to millions of iCloud accounts didn't obtain whatever log-in credentials they have through a breach of the company's services, Apple said.
"There have not been any breaches in any of Apple's systems including iCloud and Apple ID," an Apple representative said in an emailed statement. "The alleged list of email addresses and passwords appears to have been obtained from previously compromised third-party services."
A group calling itself the Turkish Crime Family claims to have login credentials for more than 750 million icloud.com, me.com and mac.com email addresses, and the group says more than 250 million of those credentials provide access to iCloud accounts that don't have two-factor authentication turned on.
Google engineers yesterday acknowledged that half of all Android devices had not received a security update in the past year, even as they argued that the firm has made progress in streamlining the open-source operating system's patching process.
"About half of devices in use at the end of 2016 had not received a platform security update in the previous year," Adrian Ludwig and Mel Mille, members of the Android security team, said in a post to a company blog.
Although Google has issued monthly security updates for Android since 2015 -- and deploys those patches to Nexis and Pixel devices as soon as they're available -- other device makers often take weeks or months to push updates to customers, or never do. Android's update problem is not new -- it's been in stark contrast to other operating systems, notably iOS, macOS and Windows, since Android's inception -- and is baked into the relationship between Google and the hardware manufacturers who build and sell phones.
The CIA has had tools to infect Apple Mac computers by connecting malicious Thunderbolt Ethernet adapters to them since 2012, according to new documents purported to be from the agency and published by WikiLeaks.
One of the documents, dated Nov. 29, 2012, is a manual from the CIA's Information Operations Center on the use of a technology codenamed Sonic Screwdriver. It is described as "a mechanism for executing code on peripheral devices while a Mac laptop or desktop is booting."
Sonic Screwdriver allows the CIA to modify the firmware of an Apple Thunderbolt-to-Ethernet adapter so that it forces a Macbook to boot from an USB stick or DVD disc even when its boot options are password protected.
The U.S. Senate has voted to kill broadband provider privacy regulations prohibiting them from selling customers' web-browsing histories and other data without their permission.
The Senate's 50-48 vote Thursday on a resolution of disapproval would roll back Federal Communications Commission rules requiring broadband providers to receive opt-in customer permission to share sensitive personal information, including web-browsing history, geolocation, and financial details with third parties. The FCC approved the regulations just five months ago.
Steven Bay, a former defense contractor, knows a thing or two about insider threats. For a brief period, he was the boss of Edward Snowden, the famous leaker who stole sensitive files from the U.S. National Security Agency.
Recalling the day he learned Snowden had been behind the NSA leaks back in June 2013, Bay said he received texts about the breaking news while in a leadership meeting at a church. The first text said "Sorry man, looks like your worst nightmare came true."
Bay was crushed: "I went out into an empty room of the church and I just melted down crying."
Most technologies go through a stage when everything seems possible. Personal computers in the early 1980s, the internet in the late 1990s and mobile apps around the beginning of this decade were like that.
But so was the first unboxing of a Galaxy Note 7. In time, either suddenly or gradually, reality sets in.
The internet of things still looks promising, with vendors and analysts forecasting billions of connected devices that will solve all sorts of problems in homes and enterprises. But the seams are starting to show on this one, too. As promising as the technology is, it has some shortcomings. Here are a few.
Developers of the popular LastPass password manager rushed to push out a fix to solve a serious vulnerability that could have allowed attackers to steal users' passwords or execute malicious code on their computers.
The vulnerability was discovered by Google security researcher Tavis Ormandy and was reported to LastPass on Monday. It affected the browser extensions installed by the service's users for Google Chrome, Mozilla Firefox and Microsoft Edge.
According to a description in the Google Project Zero bug tracker, the vulnerability could have given attackers access to internal commands inside the LastPass extension. Those are the commands used by the extension to copy passwords or fill in web forms using information stored in the user's secure vault.
Hackers claiming to have hundreds of millions of iCloud credentials have threatened to wipe date from iPhones, iPads and Macs if Apple does not fork over $150,000 within two weeks.
"This group is known for getting accounts and credentials, they have gotten credentials in the past," said Lamar Bailey, director of security research and development at Tripwire, of the purported hackers. "But whether they have that many ... who knows?"
There's another reason for not panicking, Bailey said: People can quickly make their accounts more secure, assuming the criminals have only collected, not actually compromised the iCloud accounts by changing millions of passwords.
The chances of your encountering malware on your Android phone is incredibly small, according to Google.
By the end of last year, less than 0.71 percent of Android devices had installed a "potentially harmful application," such as spyware, a Trojan, or other malicious software.
That figure was even lower, at 0.05 percent, for Android phones that downloaded apps exclusively from the Google Play store.[ Further reading: 16 Android tips and tricks you shouldn't miss ]
The internet giant revealed the figures in a new report detailing its efforts to making the Android OS secure. Thanks to better app review systems, the company is detecting and cracking down on more malware.
A group of hackers is threatening to wipe data from millions of Apple devices in two weeks if the company doesn’t pay them US$150,000.
The group, which calls itself Turkish Crime Family, claims to have login credentials for more than 627 million icloud.com, me.com and mac.com email addresses. These are email domains that Apple has allowed for users creating iCloud accounts over the years.
Even though the Turkish Crime Family hasn't been in the media spotlight before, its members claim that they've been involved in selling stolen online databases in private circles for the past few years.
The group said via email that it has had a database of about 519 million iCloud credentials for some time, but did not attempt to sell it until now. The interest for such accounts on the black market has been low due to security measures Apple has put in place in recent years, it said.
Reacting to concerns about the mass collection of photographs in police databases, U.S. lawmakers plan to introduce legislation to limit the use of facial recognition technology by the FBI and other law enforcement organizations.
The FBI and police departments across the country can search a group of databases containing more than 400 million photographs, many of them from the drivers' licenses of people who have never committed a crime. The photos of more than half of U.S adults are contained in a series of FBI and state databases, according to one study released in October.
Tavis Ormandy, a security researcher on Google’s Project Zero team, warned of flaws in LastPass browser extensions, vulnerabilities which – if a person surfed to a malicious site – would allow the malicious site to steal passwords from the password manager.
Ormandy originally said the LastPass bug affected 4.1.42 Chrome and Firefox browser extensions. He developed a working exploit for a Windows box running the LastPass Chrome extension, but said it “could be made to work on other platforms.” He sent the details to LastPass before adding:
The U.K. is joining the U.S. in its ban restricting passengers from bringing some electronic devices onto flights from the Middle East.
Phones, laptops, and tablets that are larger than 16 cm (6.3 inches) in length and wider than 9.3 cm will no longer be allowed in the cabin on select flights coming from several Middle Eastern countries, the U.K.'s department of transportation said on Tuesday.[ To comment on this story, visit Computerworld's Facebook page. ]
The U.K. said it was in "close contact" with the U.S. since the country announced its own ban on Monday. However, the U.K. made no mention of any specific risk, only that it faces "evolving" terrorism threats.