How to lock down your Android and lock out malware

Have you ever thought about all the personal information stored on your smartphone or tablet?

I mean, really thought about everything you save so that it's always at your fingertips? 

Then think about how well protected that information is.

You may not care if your list of favorite wines goes public, but what if someone were to copy your spouse’s driver’s license and Social Security numbers?

Millions of people have such data stored in their smartphones or tablets. Because mobile devices are so easy to lose or have stolen, all data on them is at substantial risk.

With Android devices, there's additional danger. They've been plagued by shoddy security and malicious apps.

Cybercrooks are getting bolder and more creative with those apps every day. Just as you think you're one step ahead of the crooks, they come up with a new way to steal your personal information.

That’s why it's vital for every Android user to learn how to lock down and protect his or her device.

Keep out the digital thievesRight now, malicious apps, which often pretend to be cheaper versions of popular apps or games, are the No. 1 risk for Android devices.

"Malicious applications targeted for Android devices [have] increased between 400 to 1,000 percent in the past 18 to 24 months," said Jerry Irvine, chief information officer of Prescient Solutions in Schaumburg, Ill.

"These malicious applications perform multiple tasks, but share one common goal — to attain the personal information on these mobile devices and push it out to criminal entities."

Malware can also be installed on an Android device in other ways, such as through websites, emails, text messages or even NFC (near-field communication) file transfers.

To best protect your phone from malware, Irvine said, download anti-virus and malware-scanning apps designed for Android devices.

Most of the better known anti-virus software companies have security apps available. Chances are you can stick with the brand you like best.

Be sure to upgrade the anti-virus software when prompted, since new malware is being released every day.

[10 Tips to Keep Your Android Phone Safe]

And the human onesBut malware isn't the only threat to the personal data on your smartphone or tablet. If the device is lost or stolen, the data's in someone else's hands.

You should consider installing a security product that regularly backs up the data on your device to a cloud-storage service — and also has a location detector and the ability to remotely wipe personal data if the device is gone for good.

The first line of defense, however, is to protect your device with a PIN, password or pattern lock. That way, no one can randomly pick it up and start checking your email.

"Passwords and PIN configurations on mobile devices can be configured to entirely wipe the device if the password is not entered correctly within a specific number of times," Irvine said.

"The security should be configured.  Strong passwords of eight or more characters should be used because they make it much harder to crack the password."

Keep your password, PIN or lock pattern truly secret by regularly wiping your device's screen clean. Repeated finger gestures will smear the glass, leaving smudge patterns that can tip off a thief.

Theft of smartphones and tablets is on the rise. Thieves have been known to swipe phones out of the hands of users who were still talking.

While these thieves may be primarily interested in the street value of the device, your unprotected data is always going to be at risk.

Considering how we use our smartphones and tablets (and got rid of address books and other tools that held our vital numbers), it's futile to recommend keeping all personally identifiable information off our gadgets.

Instead, keep the amount of such information on your device to a minimum, and make sure your phone has multiple layers of security.

• 8 Simple Tips for Securing Your Computer
• Got Money? You're a Prime Target for Identity Thieves
• 10 Best Smartphones for 2013

Copyright 2013 TechNewsDaily, a TechMediaNetwork company.

Ripple effects across Web as spam-blocking group Spamhaus hit by record-smashing cyberattack

       By Associated Press,

LONDON — A record-breaking cyberattack targeting an anti-spam watchdog group has sent ripples of disruption coursing across the Web, experts said Wednesday.
Spamhaus, a site responsible for keeping ads for counterfeit Viagra and bogus weight-loss pills out of the world’s inboxes, said it had been buffeted by the monster denial-of-service attack since mid-March, apparently from groups angry at being blacklisted by the Swiss-British group.

 “It is a small miracle that we’re still online,” Spamhaus researcher Vincent Hanna said.
Denial-of-service attacks overwhelm a server with traffic — like hundreds of letters being jammed through a mail slot at the same time. Security experts measure those attacks in bits of data per second. Recent cyberattacks — like the ones that caused persistent outages at U.S. banking sites late last year — have tended to peak at 100 billion bits per second.
But the furious assault on Spamhaus has shattered the charts, clocking in at 300 billion bits per second, according to San Francisco-based CloudFlare Inc., which Spamhaus has enlisted to help it weather the attack.
“It was likely quite a bit more, but at some point measurement systems can’t keep up,” CloudFlare chief executive Matthew Prince wrote in an email.
Patrick Gilmore of Akamai Technologies said that was no understatement.
“This attack is the largest that has been publicly disclosed — ever — in the history of the Internet,” he said.
It’s unclear who exactly was behind the attack, although a man who identified himself as Sven Olaf Kamphuis said he was in touch with the attackers and described them as mainly consisting of disgruntled Russian Internet service providers who had found themselves on Spamhaus’ blacklists. There was no immediate way to verify his claim.
He accused the watchdog of arbitrarily blocking content that it did not like. Spamhaus has widely used and constantly updated blacklists of sites that send spam.
“They abuse their position not to stop spam but to exercise censorship without a court order,” Kamphuis said.
Gilmore and Prince said the attack’s perpetrators had taken advantage of weaknesses in the Internet’s infrastructure to trick thousands of servers into routing a torrent of junk traffic to Spamhaus every second.
The trick, called “DNS reflection,” works a little bit like mailing requests for information to thousands of different organizations with a target’s return address written across the back of the envelopes. When all the organizations reply at once, they send a landslide of useless data to the unwitting addressee.
Both experts said the attack’s sheer size has sent ripples of disruptions across the Internet as servers moved mountains of junk traffic back and forth across the Web.
“At a minimum there would have been slowness,” Prince said, adding in a blog post that “if the Internet felt a bit more sluggish for you over the last few days in Europe, this may be part of the reason why.”
At the London Internet Exchange, where service providers exchange traffic across the globe, spokesman Malcolm Hutty said his organization had seen “a minor degree of congestion in a small portion of the network.”
But he said it was unlikely that any ordinary users had been affected by the attack.
Hanna said his site had so far managed to stay online, but warned that being knocked off the Internet could give spammers an opening to step up their mailings — which may mean more fake lottery announcements and pitches for penny stocks heading to people’s inboxes.
Hanna denied claims that his organization had behaved arbitrarily, noting that his group would lose its credibility if it started flagging benign content as spam.
“We have 1.7 billion people who watch over our shoulder,” he said. “If we start blocking emails that they want, they will obviously stop using us.”
Gilmore of Akamai was also dismissive of the claim that Spamhaus was biased.
“Spamhaus’ reputation is sterling,” he said.
Copyright 2013 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.

RIM urges BlackBerry users to turn off JavaScript

Research in Motion is recommending that IT departments and users disable JavaScript on their BlackBerry devices, citing a vulnerability unearthed at this year's Pwn2Own hacker challenge.

RIM may rip a page from Google for PlayBook

According to RIM, the vulnerability could allow a hacker to access a device's user data through the BlackBerry Browser if the user visits a "maliciously designed" Web site. The vulnerability only affects devices that have BlackBerry OS 6 installed, since it can only be exploited in devices that utilize the WebKit browser engine. RIM first started remaking its browser for BlackBerry OS 6 in 2009, when it purchased open source Web browser developer Torch Mobile, whose flagship Iris Browser is based on the open source Webkit browser engine. Any BlackBerry devices that contain older versions of the BlackBerry operating system will not be impacted.

RIM says the vulnerability will only allow hackers to gain access to data stored on devices' media cards and built-in media storage and that it will not give hackers access to data on the application storage portion of the phone, such as user data stored by e-mail, calendar and contact applications. So far, RIM says it has seen no actual cases of anyone exploiting this vulnerability outside of a test environment.

RIM is providing IT departments with guidelines to disable JavaScript on several BlackBerry devices, including the Torch 9800, the Bold 9700 and the Curve 9300. If this fails, RIM recommends disabling the BlackBerry Browser on devices altogether until the vulnerability can be patched.

While RIM has traditionally made its name by providing airtight security to enterprise users, it has been forced in recent years by the success of Apple's iPhone and Google's open-source Android operating system to allow more open-source and third-party applications onto its devices. In addition to its use of the open-source WebKit browser engine, RIM is also reportedly weighing whether to let its upcoming PlayBook tablet run applications designed for the Android platform.

Mobile applications have become an increasingly popular feature of smartphones over the past couple of years, especially with the high-profile launches of application shopping centers such as Apple's App Store and Google's Android Market. The most recent survey data from research firm ChangeWave shows that 14% of smartphone users said that applications were what they liked best about new smartphones, followed by ease of use (12%) and Internet access (12%). Corporate e-mail access, which has long been RIM's bread-and-butter application, was considered the most important feature by 10% of users, the survey showed

Enterprises: We'll run Windows XP even after retirement

Nearly half of the companies still using the nine-year-old Windows XP plan to keep running the aged OS even after Microsoft withdraws its support in 2014, a research analyst said today.

"IT just really, really likes the XP operating system," said Diane Hagglund, a senior analyst at Dimensional Research, which recently surveyed more than 950 IT professionals about their Windows and Microsoft Office adoption plans. "They say it's just that good, and don't want to mess with it."

According to Dimensional's poll, IT pros split on how they would handle the April 2014 retirement of Windows XP: 47% said that they would ditch XP for a newer Windows before then, while 48% claimed that they would continue using XP sans support.

Microsoft will stop supporting Windows XP after April 8, 2014 when it issues the operating system's final set of security patches.

The large number of companies that plan to keep XP on the front lines, even without support from Microsoft, stunned Hagglund. "It wasn't just very small companies saying this," she said, adding that the stick-with-XP movement was across the board.

"We're seeing a number of major financial services and manufacturing companies opting to continue running XP without support," said Hagglund. "And it's not a price issue. From the comments we did get, IT simply thinks it's a great OS, one that's still working for them."

For all their talk, enterprises don't plan on running XP forever, only for some time after the 2014 support cutoff. "I think six months or so after Microsoft ends support, they'll really quickly upgrade [to a newer Windows] as they realize the systems are vulnerable because they've not been patched," Hagglund said.

Microsoft has been pushing XP customers of all stripes, including enterprises, to upgrade to Windows 7. While Dimensional didn't query IT professionals about what operating system they were leaving behind as they migrated to Windows 7, they're doing the latter in increasing numbers.

More than a third, or 38%, of those polled said their companies have implemented a partial roll-out of Windows 7, up from 15% in January 2010 , the last time Dimensional surveyed IT administrators and staffers.

Six percent of the companies have fully deployed to Windows 7 , a six-fold increase over the 1% who said the same back in January.

"What's really interesting here is that if you look at the numbers, they've almost exactly adopted according to plan," said Hagglund, citing figures from the migration schedules expressed in January of 2010.

"That's a real indicator that Windows 7 migration is going well," she added, noting that making plan is the best that enterprises do. "No one exceeds plans," she said.

On Thursday, Microsoft cited Windows 7's adoption pace as a big reason for its better-than-expected quarterly earnings numbers. "Companies [are] adopting Windows 7 ... at historically high rates," said Peter Klein, Microsoft's chief financial officer, during a call with Wall Street analysts. Microsoft's Windows division posted revenues in the third quarter that were up 10% over same period of the year before.

The "kill switch" for Windows Phone 7 apps

Microsoft has acknowledged that it has tools in place to "take action" against Windows Phone 7 malware or offending apps.

This capability, which is also present in Google Android and Apple iOS, essentially lets Microsoft, via it's Zune-based Windows Phone 7 Marketplace, unpublish an app or in some cases remove it from a phone if the software was deemed a dangerous-enough security threat. It was dubbed a "kill switch" by UK-based PCPro.com, which broke the story this week, based on an interview with Todd Biggs, director of product management for Windows Phone Marketplace.

Microsoft has created a highly automated app testing and certification process for Windows Phone 7 apps, and Briggs made clear the company expects that system to flag most instances of problematic code. But, he says, “Market Place is a complex operation and we need to have the capability for dealing with different situations.”

As quoted in PCPro, Briggs clearly suggested the most common method of deactivating malware on the phone would be to simply yank the app from the online catalog. "[B]ut if it was very rogue then we could remove applications from handsets - we don't want things to go that far, but we could,” Biggs says.

That would most likely be done when the phone automatically and periodically checks into the catalog for downloads and updates.

The first Windows Phone 7 handsets for the U.S. become available Monday, November 8, on AT&T and T-Mobile.

The "kill switch" for Windows Phone 7 apps

John Cox
Back to Microsoft Subnet
John Cox on Wireless




Microsoft has acknowledged that it has tools in place to "take action" against Windows Phone 7 malware or offending apps.

This capability, which is also present in Google Android and Apple iOS, essentially lets Microsoft, via it's Zune-based Windows Phone 7 Marketplace, unpublish an app or in some cases remove it from a phone if the software was deemed a dangerous-enough security threat. It was dubbed a "kill switch" by UK-based PCPro.com, which broke the story this week, based on an interview with Todd Biggs, director of product management for Windows Phone Marketplace.

Microsoft has created a highly automated app testing and certification process for Windows Phone 7 apps, and Briggs made clear the company expects that system to flag most instances of problematic code. But, he says, “Market Place is a complex operation and we need to have the capability for dealing with different situations.”

As quoted in PCPro, Briggs clearly suggested the most common method of deactivating malware on the phone would be to simply yank the app from the online catalog. "[B]ut if it was very rogue then we could remove applications from handsets - we don't want things to go that far, but we could,” Biggs says.

That would most likely be done when the phone automatically and periodically checks into the catalog for downloads and updates.

The first Windows Phone 7 handsets for the U.S. become available Monday, November 8, on AT&T and T-Mobile.

Microsoft warns of new Zero-day attack affecting Internet Explorer 6, 7, 8

Today Microsoft released Security Advisory 2458511 to warn Internet Explorer users of a new zero-day attack that Microsoft has seen in the wild. It affects versions 6, 7, and 8, although Microsoft says that the default installations of IE8 make that version of the browser harder to exploit.

UPDATED: Security researchers at Symantec reported the attack to Microsoft and earlier today posted details. I'll summarize. Attackers figured out specific exploits for older versions of IE, 6 and 7 specifically. They hacked otherwise innocent Web servers and added a page with malware. They sent e-mails to specific individuals within various organizations. When those individuals visited the page, the malware told them which version of IE they were using. If it was not IE 6 or 7, the victim saw a blank Web page. If it was, the nasty page downloaded a Trojan that allowed the hacker to install commands disguised as .gif files. The victim need do nothing but visit the Web page. The owners of identified Web sites hosting the malware pages have been contacted and the files removed, but there's no telling how many more are still out there.

It is unlikely that a patch will be available by next week's Patch Tuesday, says Jason Miller, data and security team leader, Shavlik Technologies, Minneapolis, MN. However Miller says if Microsoft sees an uptick in this attack, he would expect Microsoft to release an out-of-band patch.

Microsoft explains:

"The vulnerability exists due to an invalid flag reference within Internet Explorer. It is possible under certain conditions for the invalid flag reference to be accessed after an object is deleted. In a specially-crafted attack, in attempting to access a freed object, Internet Explorer can be caused to allow remote code execution. At this time, we are aware of targeted attacks attempting to use this vulnerability."

IE 8 is less vulnerable due to "defense in depth protections" from its Data Execution Prevention (DEP) feature, which Microsoft says is enabled by default in Internet Explorer 8 on all supported Windows platforms. While Microsoft PR says that " the impact of this vulnerability is extremely limited and we are not aware of any affected customers," the security advisory also notes that black hats are trying to take advantage of the hole in the wild. Its says, "At this time, we are aware of targeted attacks attempting to use this vulnerability."

Microsoft says that IE 9 isn't affected, but remember IE 9 isn't available for XP users, not even those who are using XP SP3, which Microsoft is still supporting.

While no patch is available yet, Microsoft has offered several workarounds including:

* Override the Web site CSS style with a user-defined CSS (that's not going to make a lot of Web developer's happy).
* Deploy Microsoft's Enhanced Mitigation Experience Toolkit, is a utility that Microsoft says helps prevent vulnerabilities in software from successfully being exploited. For more information
* IE7 users are urged to enable the Data Execution Prevention (DEP) feature, although this may cause conflicts with some browser extensions.
* Read e-mails in plan text
* Set Internet and Local intranet security zone settings to "High" to block ActiveX Controls and Active Scripting in these zones

Microsoft yanks Outlook 2007 update

Microsoft last week pulled an update for Outlook 2007 issued just two days earlier, citing connection and performance problems for the unusual move.

The update was issued mid-day on Dec. 14 as part of the monthly Patch Tuesday. Within hours, users reported trouble with retrieving e-mail and major delays when switching folders.

"This latest update results in Outlook 2007 being very slow in changing folders and the archiving functionality appears to have been removed," said someone identified as "alspar" on a Microsoft support forum early Wednesday morning. "Is this an error or by design?"

Others said they couldn't send or receive e-mail, including Gmail messages, through Outlook after installing the update.

Ironically, Microsoft had billed the update, which didn't patch any security vulnerabilities, as one that contained "stability and performance improvements."

By Thursday, support forum moderators were telling users to uninstall the update.

Microsoft made that official late Friday in a post on the Outlook team's blog . "We have discovered several issues with the update and ... as of December 16, this Outlook 2007 update has been removed from Microsoft Update,"

According to Microsoft, the Tuesday update contained three flaws related to Secure Password Authentication (SPA), a Microsoft protocol used to authenticate mail clients like Outlook to a mail server; sluggish folder switching when Outlook wasn't configured to grab mail from an Exchange server; and a broken AutoArchive feature.