Архив рубрики: Security

Auto Added by WPeMatico

Consumers swap period tracking apps in search of increased privacy following Roe v. Wade ruling

Consumers are ditching their current period tracking apps in favor of what they perceive to be safer options in the wake of the Supreme Court’s Roe v. Wade decision that allows individual U.S. states to criminalize abortion. The app switching trend is impacting all manner of period tracking apps, including leading app Flo, which owns a 47% share of the period tracking app market in the U.S., according to data provided by Apptopia. The app may have both lost customers to rival apps while gaining new users from others over the weekend. Other apps are seeing similar trends.
The patterns of app switching indicate consumers are seeking increased privacy, as many of those gaining from this trend are companies that have made public statements in support of strengthened data security and privacy practices. But it’s also clear that consumers don’t necessarily have a good understanding of which apps to trust given that the current beneficiary of this increased switching activity is a potentially problematic app called Stardust, which had yet to implement its new privacy protections at the time it was making promises to users.
As a result of its claims, Stardust saw its daily average downloads increase by as much as 6,000% over the past weekend, Apptopia said. The relative newcomer to the period tracking market drew attention by promoting itself as a small, women-led team that wanted to provide users with a more secure app. Those claims resonated with consumers, driving the app to No. 1 on the App Store on Saturday. But in terms of data security, being a small team is not necessarily an advantage. TechCrunch found various data privacy issues with the version of the app that users downloaded over the weekend, including its sharing of users’ phone numbers with a third party.

Period tracker Stardust surges following Roe reversal, but its privacy claims aren’t airtight

Despite these issues, app intelligence firm Sensor Tower said the app gained 82% of its total 400,000+ lifetime installs this past Saturday through Sunday.
Another top app, Clue, also benefited from consumers seeking alternatives. Apptopia found Clue’s app saw a 2,200% increase in installs over the weekend after it made comments in the press that it won’t divulge sensitive information to states. Sensor Tower reported Clue had also reached its highest-ever rank on Saturday as the No. 15 overall free app on the App Store. It has since dropped to No. 93, which suggests the rank change had been the result of a surge of app switchers.
Image Credits: Clue
Several other apps saw increased installs on Saturday, June 25, too. Compared with the month of June, Glow’s ovulation app saw its average daily downloads jump 21% and its period tracker Eve saw average daily installs increase 83%, Apptopia said. An app called Natural Cycles – Birth Control saw average daily installs rise 53%; another called Period Tracker by GP Apps saw a 17% increase; and the app Femometer saw a 10% increase. Single-digit increases were also seen in apps, including My Calendar – Period Tracker and Ovia Fertility & Cycle Tracker, the firm found.
Finally, leading app Flo moved up slightly on Saturday as a result of the app switching activity. Flo jumped from No. 197 on June 23 before the ruling to No. 187 on Saturday, June 25, Sensor Tower said. It’s now moved up more to No. 180 as of the time of writing. It’s worth noting that Flo’s average daily installs had been on the decline for several months, Apptopia had reported — in part, likely due to news of its 2021 settlement with the FTC over earlier privacy violations. That indicates consumers had been thinking about data privacy well before the Supreme Court ruling.
Image Credits: Flo (opens in a new window)
After the court’s decision on Friday, Flo issued a statement in hopes of stemming the tide of app switchers or those inclined to delete their accounts. It said:
Flo will always stand up for the health of women, and will do everything in its power to protect the data and privacy of our users. To add to our security measures already in place (read more about that here), we will soon be launching a new feature called “Anonymous Mode” – an option that allows users to remove their personal identity from their Flo account. Lastly, Flo will never require a user to log an abortion or offer details that they feel should be kept private, and users can delete their data at any time. We firmly believe that our users deserve complete control over their data and we are here to support our users every step of the way.
Clue also issued a lengthy response to Roe v. Wade on its website, which stressed its adherence to strict European data privacy laws and use of encryption. GP Apps, the maker of Period Tracker, published a strong statement, as well, though its privacy policy indicates that it would comply with legal requests and subpoenas. (However, it noted that consumers can opt to use its account without an online account, which would then only store data locally on the user’s device.) Other companies have published statements on their websites and social media accounts, as well.
But without a deeper analysis of each company’s privacy policy and more sophisticated testing of each app’s privacy and security protections, it’s hard to recommend that the use of any third-party period tracking app is a 100% safe decision at this time, regardless of their statements and claims.
One possible solution to this problem is to simply use Apple’s Health app alone for the time being, where end-to-end encryption of users’ Health records is available through iCloud. Unfortunately, data on Apple’s first-party apps isn’t available, so we’ll never know how many consumers made this choice.

Supreme Court overturns Roe v. Wade: Should you delete your period-tracking app?

Consumers swap period tracking apps in search of increased privacy following Roe v. Wade ruling

Ivanti has acquired security firms MobileIron and Pulse Secure

IT security software company Ivanti has acquired two security companies: Enterprise mobile security firm MobileIron and corporate virtual network provider Pulse Secure.
In a statement on Tuesday, Ivanti said it bought MobileIron for $872 million in stock — with 91% of the shareholders voting in favor of the deal — and acquired Pulse Secure from its parent company Siris Capital Group, but did not disclose the buying price.
The deals have now closed.

Ivanti was founded in 2017 after Clearlake Capital, which owned Heat Software, bought Landesk from private equity firm Thoma Bravo, and merged the two companies to form Ivanti. The combined company, headquartered in Salt Lake City, focuses largely on enterprise IT security, including endpoint, asset and supply chain management. Since its founding, Ivanti went on to acquire several other companies, including U.K.-based Concorde Solutions and RES Software.
If MobileIron and Pulse Secure seem familiar, both companies have faced their fair share of headlines this year after hackers began exploiting vulnerabilities found in their technologies.
Just last month, the U.K. government’s National Cyber Security Center published an alert that warned of a remotely executable bug in MobileIron, patched in June, allowing hackers to break into enterprise networks. U.S. Homeland Security’s cybersecurity advisory unit CISA said that the bug was being actively used by advanced persistent threat (APT) groups, typically associated with state-backed hackers.
Meanwhile, CISA also warned that Pulse Secure was one of several corporate VPN providers with vulnerabilities that have since become a favorite among hackers, particularly ransomware actors, who abuse the bugs to gain access to a network and deploy the file-encrypting ransomware.

As ransomware gets craftier, companies must start thinking creatively

Ivanti has acquired security firms MobileIron and Pulse Secure

Apple, Opera and Yandex fix browser address bar spoofing bugs, but millions more still left vulnerable

Year after year, phishing remains one of the most popular and effective ways for attackers to steal your passwords. As users, we’re mostly trained to spot the telltale signs of a phishing site, but most of us rely on carefully examining the web address in the browser’s address bar to make sure the site is legitimate.
But even the browser’s anti-phishing features — often the last line of defense for a would-be phishing victim — aren’t perfect.
Security researcher Rafay Baloch found several vulnerabilities in some of the most widely used mobile browsers — including Apple’s Safari, Opera and Yandex — which if exploited would allow an attacker to trick the browser into displaying a different web address than the actual website that the user is on. These address bar spoofing bugs make it far easier for attackers to make their phishing pages look like legitimate websites, creating the perfect conditions for someone trying to steal passwords.

Riot automatically educates your team about phishing

The bugs worked by exploiting a weakness in the time it takes for a vulnerable browser to load a web page. Once a victim is tricked into opening a link from a phishing email or text message, the malicious web page uses code hidden on the page to effectively replace the malicious web address in the browser’s address bar to any other web address that the attacker chooses.
In at least one case, the vulnerable browser retained the green padlock icon, indicating that the malicious web page with a spoofed web address was legitimate — when it wasn’t.

An address bar spoofing bug in Opera Touch for iOS (left) and Bolt Browser (right). These spoofing bugs can make phishing emails look far more convincing. (Image: Rapid7/supplied)

Rapid7’s research director Tod Beardsley, who helped Baloch with disclosing the vulnerabilities to each browser maker, said address bar spoofing attacks put mobile users at particular risk.
“On mobile, space is at an absolute premium, so every fraction of an inch counts. As a result, there’s not a lot of space available for security signals and sigils,” Beardsley told TechCrunch. “While on a desktop browser, you can either look at the link you’re on, mouse over a link to see where you’re going or even click on the lock to get certificate details. These extra sources don’t really exist on mobile, so the location bar not only tells the user what site they’re on, it’s expected to tell the user this unambiguously and with certainty. If you’re on palpay.com instead of the expected paypal.com, you could notice this and know you’re on a fake site before you type in your password.”
“Spoofing attacks like this make the location bar ambiguous, and thus, allow an attacker to generate some credence and trustworthiness to their fake site,” he said.
Baloch and Beardsley said the browser makers responded with mixed results.
So far, only Apple and Yandex pushed out fixes in September and October. Opera spokesperson Julia Szyndzielorz said the fixes for its Opera Touch and Opera Mini browsers are “in gradual rollout.”
But the makers of UC Browser, Bolt Browser and RITS Browser — which collectively have more than 600 million device installs — did not respond to the researchers and left the vulnerabilities unpatched.
TechCrunch reached out to each browser maker but none provided a statement by the time of publication.

A simple bug makes it easy to spoof Google search results into spreading misinformation

Apple, Opera and Yandex fix browser address bar spoofing bugs, but millions more still left vulnerable

Google is making autofill on Chrome for mobile more secure

Google today announced a new autofill experience for Chrome on mobile that will use biometric authentication for credit card transactions, as well as an updated built-in password manager that will make signing in to a site a bit more straightforward.
Image Credits: Google
Chrome already uses the W3C WebAuthn standard for biometric authentication on Windows and Mac. With this update, this feature is now also coming to Android .
If you’ve ever bought something through the browser on your Android phone, you know that Chrome always asks you to enter the CVC code from your credit card to ensure that it’s really you — even if you have the credit card number stored on your phone. That was always a bit of a hassle, especially when your credit card wasn’t close to you.
Now, you can use your phone’s biometric authentication to buy those new sneakers with just your fingerprint — no CVC needed. Or you can opt out, too, as you’re not required to enroll in this new system.
As for the password manager, the update here is the new touch-to-fill feature that shows you your saved accounts for a given site through a standard Android dialog. That’s something you’re probably used to from your desktop-based password manager already, but it’s definitely a major new built-in convenience feature for Chrome — and the more people opt to use password managers, the safer the web will be. This new feature is coming to Chrome on Android in the next few weeks, but Google says that “is only the start.”
Image Credits: Google
 

Google is making autofill on Chrome for mobile more secure

Rapid Huawei rip-out could cause outages and security risks, warns UK telco

The chief executive of UK incumbent telco BT has warned any government move to require a rapid rip-out of Huawei kit from existing mobile infrastructure could cause network outages for mobile users and generate its own set of security risks.
Huawei has been the focus of concern for Western governments including the US and its allies because of the scale of its role in supplying international networks and next-gen 5G, and its close ties to the Chinese government — leading to fears that relying on its equipment could expose nations to cybersecurity threats and weaken national security.
The UK government is widely expected to announce a policy shift tomorrow, following reports earlier this year that it would reverse course on so called “high risk” vendors and mandate a phase out of use of such kit in 5G networks by 2023.
Speaking to BBC Radio 4’s Today program this morning, BT CEO Philip Jansen said he was not aware of the detail of any new government policy but warned too rapid a removal of Huawei equipment would carry its own risks.
“Security and safety in the short term could be put at risk. This is really critical — because if you’re not able to buy or transact with Huawei that would mean you wouldn’t be able to get software upgrades if you take it to that specificity,” he said.
“Over the next five years we’d expect 15-20 big software upgrades. If you don’t have those you’re running gaps in critical software that could have security implications far bigger than anything we’re talking about in terms of managing to a 35% cap in the access network of a mobile operator.”
“If we get a situation where things need to go very, very fast then you’re in a situation where potentially service for 24M BT Group mobile customers is put into question,” he added, warning that “outages would be possible”.
Back in January the government issued a much delayed policy announcement setting out an approach to what it dubbed “high risk” 5G vendors — detailing a package of restrictions it said were intended to mitigate any risk, including capping their involvement at 35% of the access network. Such vendors would also be entirely barred them from the sensitive “core” of 5G networks. However the UK has faced continued international and domestic opposition to the compromise policy, including from within its own political party.
Wider geopolitical developments — such as additional US sanctions on Huawei and China’s approach to Hong Kong, a former British colony — appear to have worked to shift the political weather in Number 10 Downing Street against allowing even a limited role for Huawei.
Asked about the feasibility of BT removing all Huawei kit, not just equipment used for 5G, Jansen suggested the company would need at least a decade to do so.
“It’s all about timing and balance,” he told the BBC. “If you wanted to have no Huawei in the whole telecoms infrastructure across the whole of the UK I think that’s impossible to do in under ten years.”
If the government policy is limited to only removing such kit from 5G networks Jansen said “ideally” BT would want seven years to carry out the work — though he conceded it “could probably do it in five”.
“The current policy announced in January was to cap the use of Huawei or any high risk vendor to 35% in the access network. We’re working towards that 35% cap by 2023 — which I think we can make although it has implications in terms of roll out costs,” he went on. “If the government makes a policy decision which effectively heralds a change from that announced in January then we just need to understand the potential implications and consequences of that.
“Again we always — at BT and in discussions with GCHQ — we always take the approach that security is absolutely paramount. It’s the number one priority. But we need to make sure that any change of direction doesn’t lead to more risk in the short term. That’s where the detail really matters.”
Jansen fired a further warning shot at Johnson’s government, which has made a major push to accelerate the roll out of fiber wired broadband across the country as part of a pledge to “upgrade” the UK, saying too tight a timeline to remove Huawei kit would jeopardize this “build out for the future”. Instead, he urged that “common sense” prevail.
“There is huge opportunity for the economy, for the country and for all of us from 5G and from full fiber to the home and if you accelerate the rip out obviously you’re not building either so we’ve got to understand all those implications and try and steer a course and find the right balance to managing this complicated issue.
“It’s really important that we very carefully weigh up all the different considerations and find the right way through this — depending on what the policy is and what’s driving the policy. BT will obviously and is talking directly with all parts of government, [the National] Cyber Security Center, GCHQ, to make sure that everybody understands all the information and a sensible decision is made. I’m confident that in the end common sense will prevail and we will head down the right direction.”
Asked whether it agrees there are security risks attached to an accelerated removal of Huawei kit, the UK’s National Cyber Security Centre declined to comment. But a spokesperson for the NCSC pointed us to an earlier statement in which it said: “The security and resilience of our networks is of paramount importance. Following the US announcement of additional sanctions against Huawei, the NCSC is looking carefully at any impact they could have to the U.K.’s networks.”
We’ve also reached out to DCMS for comment. Update: A government spokesperson said: “We are considering the impact the US’s additional sanctions against Huawei could have on UK networks. It is an ongoing process and we will update further in due course.”

Rapid Huawei rip-out could cause outages and security risks, warns UK telco