Showing posts with label Vulnerability Management. Show all posts
Are Your WhatsApp Encrypted Group Chats Exposed To Strangers?
A team of security researchers from the Ruhr University of Bochum, Germany has revealed a series of vulnerabilities in the popular instant messaging app WhatsApp.
According to a Wired report, the flaws allow a person with the control of WhatsApp’s servers to add anyone to a WhatsApp group without admin permission.
Once added to a group, the respective encryption keys of all the group members get shared automatically with the new user. So, a newly added eavesdropper can easily read all the new end-to-end encrypted messages exchanged between the members. But not the older messages and the ones for which the stranger doesn’t have the end-to-end encryption key.
The report was quick to ring the bell at the house of WhatsApp’s daddy Facebook. Its chief security officer Alex Stamos made multiple tweets as a response to Wired’s report.
“Read the Wired article today about WhatsApp – scary headline! But there is no a secret way into WhatsApp groups chats. The article makes a few key points.”
“Everyone in the group would see a message that a new member had joined,” he argued. But should that be considered as a safety measure, relying on the alertness of the members to make sure some eavesdropper has not entered their WhatsApp group?
“WhatsApp is built so group messages cannot be send to hidden users and provides multiple ways for users to confirm who receives a message prior to it being sent.”
Stamos said that WhatsApp has seen the researchers’ findings. But preventing a possible attack would require to let go of a popular feature called “group invite links” which allows anyone with a link to join a WhatsApp group. “There may be a way to provide this functionality with more protections, but it’s not clear cut.”
Even if such an attack could be performed, how many people would have access to WhatsApp’s servers except their employees and governments wanting to conduct surveillance? An experienced hacker would first have to compromise the servers before adding an eavesdropper to the group.
According to Maxie Marlinspike, who developed the Signal protocol, it’s not possible to suppress the alerts sent when someone joins the group, contrary to the researchers’ claim. It turns out, it’s not possible for someone to snoop into group chats and hacking the servers is not that easy.
Commenting on the report, Mike said that the article is a better example of the problems associated with security industry and how research is done today. “I think the lesson to anyone watching is clear: don’t build security into your products, because that makes you a target for researchers, even if you make the right decisions,” he wrote.
6 Ways to Improve Your Organisation's Malware Defences
Malware is one of the most common types of security attack, so it's vital that your organisation takes steps to protect its sensitive data.
What is Malware?
Malware is malicious software that is unintentionally installed by a user and designed to attack your systems, devices or data. Once installed on one device, it can quickly spread through an organisation’s network, compromising value data in the process.
Thankfully, your organisation doesn't have to be powerless against the threat of malware.
1) Install Automated Anti-Malware Tools
Your organisation should start with the obvious (but very important) task of installing a comprehensive suite of automated anti-malware tools. This should include:
- Anti-virus
- Anti-spyware
- Personal firewalls
- WAFs (Web Application Firewalls) and WAMs (Web Anti Malware)
These anti-malware tools should be installed across all workstations, servers and mobile devices to protect the whole of your organisation’s network.
2) Choose Cloud-Based Software
Your anti-malware software is only as good as its ability to communicate with every machine on the system. When new malware signatures are identified, this new information needs to be sent to every machine on the network, quickly and efficiently.
The advantage of cloud-based software over locally-hosted software is that if one machine or server is compromised, it doesn’t impact upon your software’s ability to communicate with the rest of your system- allowing the new signature to be uploaded to the cloud, protecting the rest of your network from the threat.
3) Disable Auto-Run
Auto-run is malware’s enabler friend. Malware can enter through any number of points, like email attachments, web pages and removable media.
You should configure all of your organisation’s laptops, workstations and servers so that they don’t auto-run content from removable media like thumb drives, USB hard drives or CDs. This will close off one potential entry point.
Additionally, you should configure your systems so that they automatically perform an anti-malware scan of removable media when it’s inserted. This will protect against user actions, such as accidentally opening a compromised file.
4) Sandbox Email Attachments
Email sandboxing is a way of executing your email software and attachments in a contained environment, separate from your organisation’s IT infrastructure. This protects your organisation against malicious attachments and executables: the sandbox can be deleted, taking any malicious content with it
5) Develop an Incident Response Process
Your organisation needs to improve communication between your IT and security teams by developing and implementing a defined incident response process.
In the event of a security breach, IT need to supply your security team with examples of malware that has successfully bypassed their system, so that security can update and improve their anti-malware software.
6) Analyse the efficacy of Your Malware Defences
With new threats and vulnerabilities being identified all the time, it is important that your organisation is continually testing and evaluating its malware defences.
To analyse the efficacy of your malware defences, you need to measure the following:
- How long does it take the system to identify malicious software that is installed or executed on a computer system?
- How long does it take the system to send notifications to your security team that malicious code has been identified?
- Does the system have the ability to block installation, prevent execution, or quarantine malicious software?
- Does the system have the ability to identify where in the organisation the malicious software was identified?
- How long does it take the organisation to completely remove the malicious code after it has been identified?
When it comes to malware defences, you can’t just ‘set it and forget it’. New threats are being developed all the time, so you need to be continually improving your organisation’s security.
Cyber Security Graduate Certificate
The Cyber Security graduate certificate provides a professional, technical and policy view of the challenges created by rapid advancements in information technology. You'll examine principles of computer systems security, including attack protection and prevention. By combining computer science and application, this program's interdisciplinary approach will give you the vital skills needed for today's cyber workforce.
You Will Learn
- Basic theory and practice of cryptographic techniques
- Digital forensics for identifying potential threats
- Legal issues in computer security
- Privacy policy business implications
- Designs for network perimeter defenses
- Testing methods for possible system penetrations
Tag :
Application Security,
Cloud Computing,
Computer Forensics,
Computer Security,
Cyber Security,
Cybersquatting,
Forensic Analysis,
Hacking news,
Information Security,
Intrusion Detection,
ISO 27001 Lead Auditor,
Malware Analysis,
Network Security,
Penetration Testing,
Security Audits,
Security Research,
TCP/IP,
Vulnerability Assessment,
Vulnerability Management,
Web Application Security