Smartphones in the enterprise: A false sense of security

Security has been about evolution. First came the PC, big and clunky it taught us about the importance of keeping the good guys in and the bad guys out. Then came the era of laptops and, well, losing them which showed – at the expense of some very red faces - the importance of ensuring secure remote access. And now comes the new generation; the smartphone. Surely by now we’ve learnt our lessons from the past and are well prepared for the next iteration of security challenges that the move to mobility will bring with it?

Well, not quite. In many ways, it feels like Groundhog Day, with the same mistakes being played out. The 2011 Get Safe Online campaign kicked off with a warning aimed at educating consumers about the security scams out there targeting their smartphone. But with more and more smartphones being deployed in the corporate environment, arguably it is businesses that have the most to lose.

Smartphones have become the bedrock of any remote access strategy. Easy to use and intuitive they enable staff to access email, download and work on attachments as well as access corporate weband cloud-based applications such as Salesforcewhilst on the move. But it is this very ease of use that lulls people into a false sense of security. Would you like it to remember your password for next time? Yes please. Would you like to enable automatic log on? Yes please. All these quirks designed to make our lives easier, only hasten the speed with which a hacker - or even someone that has found your lost device - can get into sensitive files or the corporate network and do damage.

For example, most mobile devices from tablet PCs to smartphones are set up to automatically search for and log onto the nearest WiFi hotspot. And who says no to free WiFi? But with some cheap equipment from a high street electrical store a hacker can set up a ‘fake’ WiFi spot and snaffle all the passwords they need to break into the corporate network using someone else’s identity in a matter of seconds. And as the lines between personal and professional use of smartphones start to blur, it is becoming even harder to mitigate the risks.

Most IT departments and security chiefs know that if their company rolls out iPhones, staff will download applications from the App Store. Until last week they were probably quite relaxed about this as Apple has a ‘quality control’ process in place before apps can be sold and downloaded. But the discovery of a rogue app has shown that Apple’s processes are foolproof. What looked like a harmless appwas actually designed to unleash chaos. And what of Android? Predicted by Ovum to gobble up a 25 per cent share of the enterprise market in next five years. Yet its Market Place has no rules or any way of governing what applications are uploaded onto its Market Place and made available to an unsuspecting public.

These are just two examples of how thecommercially valuable information sitting on smartphones is vulnerable to attack from different angles. Like it or not, if your organisation has smartphones you’ve also got some serious security blind spots. It’s hard to think that one small device could have big security consequences, but it does.In many ways it is like embarking on security education all over again. The trend towards bring your own device (BYOD) is further muddying the water, but businesses should make no mistake - it is their responsibility to secure their data.

Right now, companies can’t validate if people accessing the network are who they say they are. Instead they rely on static passwords to authenticate the person rather than one time use passwords which are unique and can’t be stolen. Traditional approaches to passwords are the weakest link in any security policy; companies shouldn’t continue to make the same mistake in the mobile world.

Spy Smartphone Software Tracks 'Every Move'

Click for video
http://news.sky.com/home/technology/article/16099260

Tax rebates stolen by Revenue and Customs hackers – from today’s Sunday Times

Fraudsters have found a way to hack into government tax records and divert refunds meant for others into their own bank accounts.

An investigation by The Sunday Times has revealed that criminals are secretly examining HM Revenue & Customs’ records looking for anyone who has paid too much tax. They then change the details of the bank accounts into which the repayments are to be made.

Alternatively, the hackers file fictitious tax returns showing large overpayments directly into the HMRC computer in the names of genuine taxpayers, then ask for refunds.

Victims become aware of the scam only when they are officially contacted by HMRC and told an overpayment is being transferred into their account.

HMRC is now facing questions over its security procedures and how the hackers are able to infiltrate its records. Experts claim it has failed to react as promptly as the banks to the risk of online fraud.

Roger Symes, 53, a ship broker from Surbiton, in south-west London, received a letter last month from HMRC advising him of a refund. He said: “They gave details of a bank account into which they were paying the money, but it wasn’t my bank account.

“My accountant said he had the same problem with 18 other clients.” The refunds applied for were between £100 and £4,000.

The hackers are accessing the tax files using the sign-on and passcodes assigned to accountants who file clients’ tax returns online. How they are obtaining these security details is unclear. It is not known whether it is via computer attacks on individual accountancy firms or by breaching HMRC’s own systems.

One hacker who spoke to The Sunday Times this year said he had accessed HMRC’s systems and had been able to obtain details of agent sign-ons and passcodes. A security expert said the claim was credible but HMRC denied its systems had been compromised.

Once a hacker has an agent sign-in, he can read the tax records of all the accountant’s clients, amend them and change the bank account details. Accountants who have spoken to this newspaper said hackers have been accessing taxpayer records for at least two years.

Claire Savage, a chartered accountant in Milton Keynes, Buckinghamshire, spotted irregularities in one of her clients’ files in June last year.

She said: “I called him up to ask about his new bank account, which turned out not to be his at all. When I realised that security had been breached I went through all of my clients’ files. A fair chunk of them — around 10 — were affected, and repayments of up to £3,000 had been requested in each case.” None of Savage’s clients lost money to the fraudsters.

Ralph Hayden, a chartered accountant at GW Cox & Co in Frinton-on-Sea, Essex, said 41 of his clients had been affected by a similar scam, which was first noticed in November 2009.

He said: “HMRC said that it must be our systems that had been breached but we called in computer experts who confirmed that it definitely wasn’t.

“In most cases, a tax return had not yet been filed, so a false return was submitted. In others, their returns had been edited, so that a repayment was now due. HMRC were not advising their frontline staff in case it was an inside job.”

On hmrconline.com, a blog about the HMRC, one taxpayer reveals that his accountant was also targeted. The posting states: “We recently returned from holiday to the news that 91 of our accountant’s client accounts had been hacked at the HMRC government gateway website.

“Hackers had accessed information on 91 individuals or organisations and had entered false end-of-year accounts in order to claim self-assessment refunds.

“We then received a letter from HMRC to advise us that the refunds were on their way to what we knew were false accounts. They actually paid out. HMRC now apparently know what they have done but to add insult to injury they have now started to send demands for repayment to the people [whose] accounts had been hacked.”

Unlike HMRC, the big banks ask customers conducting transactions online to provide additional passcodes for each financial transaction. These are generated by inserting a bank card into a hand-held reader provided by the bank.

Jason Hart, managing director of Cryptocard, a computer security company, said: “If you just had a static passcode, then once it’s compromised, you’re going to be a massive target for the fraudsters. It’s an invisible threat because they can get into your system at any time and you don’t even realise.”

Spy Smartphone Software Tracks 'Every Move'

11:14am UK, Sunday October 30, 2011

Sam Kiley, security editor

As marketing pitches you don't get much lower: "Track every text, every call and every move your spouse makes…"

Yes, software manufacturers have harnessed the green-eyed monster.

"A cell phone plays a role in almost every affair," said one producer of mobile phone spyware.

Another spelled it out: "When you begin to notice signs of a cheating spouse, the best way to catch that cheat is to spy on his or her cell phone using spy software.

"Such software is required because the cell phone has become the modern day keeper of secrets and its uses are as versatile and diverse as their makes and models."

But it is not just for jealous partners.

There is no way that a victim would know his phone had been comprehensively hacked.

Jason Hart, cyber security expert

Software designed to completely mine every secret on a smartphone can track its users, record their calls, copy their emails, read their text messages and bug the rooms the phones are sitting in.

Jason Hart, a cyber security expert with Cryptocard, explained how easy it is to turn a mobile phone into a pocket spy.

It starts with a little 'social engineering'.

By hacking the phone of someone the victim might trust, and learning something about them from reading their Tweets and Facebook page, the attacker will send a personalised email from a known account.

The user opens an email and a document, a picture, letter or pdf file.

A programme can be embedded in the attached document which takes the hacked user's phone off to a secret website site which covertly downloads spying software onto the smartphone.

Shortened weblinks are also a risk.

"Using Facebook and Twitter (and) getting an individual to click on a shortened link would actually take them to a website and automatically install malware," said Mr Hart.

"There is no way that a victim would know his phone had been comprehensively hacked."

Spyware 'can covertly operate all of a smartphone's functions from afar'

Attacks on smartphones shot up by 46% last year, and this year the percentage is likely to be in the thousands.

We loaded the commercial software onto my phone and very quickly Mr Hart was watching my emails come through.

The vendors of the software promised that he would be able to intercept and listen to my calls - we could not get that to work. But, as a bug, my phone was close to perfect.

The software meant Mr Hart could dial into my phone and it would secretly answer - broadcasting any conversation I was having near the handset back to him.

"Once a criminal or spy has got hold of software like this and loaded it onto your phone, there is very little indeed that you will be able to do either to detect or, or defend yourself. This is a total compromise," Mr Hart said.

Spyware can covertly operate all of a smartphone's functions from afar, turning it on and off, and stealing its secret contents.

Almost 500,000 new smartphones will be sold this year around the world.

Malware developers are running ahead of the industry's ability to develop tools which, in any case, would inevitably restrict how useful smartphones can be to a customer.

But, as losses to intellectual property theft are estimated to cost the UK £17bn a year, it is clear companies will be demanding an air gap between smartphones used for business - and smartphones used for everything else.

So, for the skiving worker, the truant teenager and the faithless spouse, there can only be a few words of advice - that phone isn't smart, it's a sneak.

Password Risks - Smart Phones at risk

The world is facing a wave of cyber crime thanks in large part to our newly-found addiction to the smartphone.

An estimated 480 million smartphones will be sold this year. They are indeed wonders of technology.
Henry Harrison, from UK cyber security experts Detica, said: "This is a fully fledged computer that's sitting in your pocket." It can, and probably will, betray you as a result.
The flaw in the smartphone is that it is too useful and too user friendly - for users who trade convenience for security.

They collect our emails, store our bank details, we tweet and use Facebook on them. They are our bank vault, our confidante, our guide.
But as Cryptocard's Jason Hart demonstrated - they are our new Achilles heel.
Mr Hart purchased a cheap item of equipment from a high street electrical store and downloaded free software from the internet - all he needed to set up an "evil twin" Wi-Fi connection.

Criminals use these to harvest passwords and other sensitive data from smartphones or computers - often giving their Wi-Fi hotspots fake names familiar to punters at cafes and in airports.

Full story: http://news.sky.com/home/technology/article/16090250

Facebook Passwords

FACEBOOK USERS EXPOSE PASSWORDS ONLINE

Social media users are increasing their chances of identify fraud, by providing clues to their online passwords.

A study by me commissioned by life assistance company CPPGroup Plc (CPP) has revealed that one third (32%) of Facebook profiles contain at least two pieces of personal information such as their mother’s maiden name, date of birth, hobbies or children’s names. This information is often also used as a password or as an answer to a security question when users look to reset their online account log-in details.

In the study, details including the name of the user’s first school (64%), employer (46%), dates of birth (25%), children’s names (25%) and favourite football team (17%) were found to be visible on many people’s Facebook profiles.

As the most active social media users, those aged 18 to 24 with a Facebook account are the most likely to publicise their personal information – and often to complete strangers. This age group has on average more than 250 friends but 81%[i] say they do not trust all of their Facebook ‘friends’. Half (50%) have accepted a friend request from a total stranger and 9% would accept an invitation from someone they did not know if they were good looking or popular.

But it’s not just the 18 to 24 year olds who are making themselves vulnerable - users of all ages are putting themselves at risk. One third (33%) of all those with a Facebook account admit to accepting an invitation from people they had never met before, with 38%[ii] confessing they don’t know everyone they are friends with on the site.

Over half (52%) of the Facebook account holders questioned had received friendship requests from strangers. And despite recent media controversy around privacy and security on the site, one in twenty (6%) users allow anyone and everyone to see their entire profile.

Danny Harrison, CPP’s Identity fraud specialist is calling on individuals to not use personal information for online passwords or security questions.

“It isn’t a good idea to use personal information for passwords online. Sharing is the whole point of Facebook and other social media sites, so users are naturally going to promote their personal information online. The problem is this information could be used by fraudsters to reset passwords and access people’s online accounts. To compound the problem, there are tools available online that can capture keywords from a website, including a Facebook profile, and others which will trial variations of the identified keywords until a password match is found.

For this reason, we are advising people to not use personal information as a means to verify their online identity and facilitate access to their online accounts.”

Personal information most commonly used as passwords[iii]:
1. Interests
2. Hobby
3. Favourite football team
4. Favourite football player
5. Children’s names
6. First school
7. Pet’s name
8. Dates of Birth
9. The user’s name
10. Maiden name

For further details please refer to my white paper.

Sky News Live Web Chat

Join Our Chat On Smartphone Security

Wifi can make smartphones potentially vulnerable to hackers

11:18am UK, Monday October 17, 2011

The growing number of iPhones, BlackBerrys and other smartphones provide an opportunity for cyber criminals to steal your data.

More than four million people in the UK have been the victims of identity fraud, with wifi access meaning secret passwords stored on your devices are vulnerable.

Ethical hacker Jason Hart answers your questions on how to keep your smartphone safe.

RECOMMENDED STORIES

Just how easy is it to hack into your life?

From Facebook to pins and passwords, invading our lives couldn’t be easier, finds Neil Tweedie

Last week I was asked by Neil Tweedie to demonstrate how easy it is for someone to hack into your life. After three questions about his family i tap away on my keyboard. Two minutes later - just two minutes - an email arrives in Neil's work inbox.

“I didn’t need all three answers, just the one,” explains the cyber security adviser. “Now I have control of your email and with it knowledge of your financial transactions, interests and friends. I can access your online accounts and use your credit card details to go shopping.”

Hacking is back in the news. This week Ryan Cleary was arrested at his home in Essex and charged with disrupting the website of Britain’s Serious Organised Crime Agency (Soca).

Agencies in the United States are also understood to be investigating whether he was involved in similar attacks on the United States Senate, the Central Intelligence Agency and Sony by an international hacking ring called LulzSec (short for Laugh Out Loud Security). Cleary is 19 and, according to his mother, a recluse, leaving his bedroom only rarely. But for hackers, the world, the cyber world, is their oyster. They can pay you a visit, harvest your most sensitive information, and disappear without trace.

For the full story please refer to: http://www.telegraph.co.uk/finance/newsbysector/mediatechnologyandtelecoms/digital-media/8597757/Just-how-easy-is-it-to-hack-into-your-life.html

E-bay phones blog post

In conducting a recent experiment for CPP into personal data left on second hand mobile phones and SIM cards, I’ve revealed just how unaware users are of the amount and nature of personal information left on their old mobile devices – even when they feel their phone has been wiped.

Due to rapid technological advances, smartphones have much more memory and capability to save personal data, increasing the risk of identity fraud to users. This threat will only increase further if people continue to store data, including credentials like usernames and passwords, on their mobile phones.

Over half of the 35 used mobile phones and 50 SIM cards analysed contained personal information on them - 247 individual pieces of data in total. The information recovered included personal and at times, highly sensitive information which, fallen into the wrong hands, could put the previous owner at direct risk of identity fraud.

One thing that was clear from the investigation was that perhaps unsurprisingly - due to their increasingly central role in users’ day to day lives - smartphones hold much more personal information on them about their former owner compared to older mobile phone models. An analysis of one smartphone alone uncovered usernames, passwords, credit card information, videos, company information, photos, email addresses and notes - certainly enough information to start a social engineering attack. For a start, a fraudster would quite easily be able to take ownership and control of the previous owner’s email account, login to online shopping sites they had visited and purchase items fraudulently.

The worrying combination is this: most mobile phones do not allow a user to totally remove all personal content or user data, and the ability to recover deleted data from a mobile is a very simple process that can be undertaken with limited technical knowledge. For the purposes of this experiment, I used SIM card readers and software that can be easily accessed in the public domain.


These results highlight a clear requirement for heightened awareness amongst consumers about the need for digital security on their phones. An effective way for this threat to be reduced is by the use of Two Factor Authentication, meaning the user generates a onetime password on demand. The sooner a commodity based authentication service is available the sooner we are going to minimise the risk.

But until such an authentication is commonplace, what can consumers do to protect themselves from passing on their personal data in their old phones or SIMs? In the first instance, never keep an old SIM card – remove it and destroy it. Also, regardless of whether they intend to sell on their mobile phone, users need to be careful not to store vast amounts of personal information on their devices. The less data that’s on a mobile device in the first place, the easier it will be to wipe and protect the user. Other keys steps to help consumers protect themselves include:

• Restore all factory settings - This is the first step to take to conduct a top level clearance of data on the handset
• Delete any back-ups - Even if data stored on a smartphone, PDA or laptop is securely removed from the mobile device, that’s not to say it won’t exist on a back up elsewhere
• Log out and delete – It’s vital to log out of social network sites accessed on the phone as well as wireless connections, company networks and applications. Once logged out, delete passwords and any wireless connections.
• Various passwords - The use of the same ID/password combination on multiple systems, and storage of them on mobile phones should be avoided. If it is necessary to store these details on a phone, it’s best to try and use a picture reminder of the password.

Remember, if a phone is being sold on to a retailer, it should be wiped and the SIM card destroyed.

If you want more information on how to protect yourself or see how these experiments worked, please visit CPP’s blog