Sophos Home - security for up to 10 PCs and Macs

I don't usually promote commercial products on this blog but Sophos are giving away Sophos Home free for the whole family.

Sophos Home is a full-featured computer security product that protects up to 10 personal Mac and Windows computers from malware/viruses, malicious software, and inappropriate websites. It's good to see Mac security included.   With no credit card required and no ads. You can get it from Sophos here.   Of course for total coverage you will also need tablet and smartphone security.

When Selling Your Used Smartphone, You Could Be Selling Your Personal Data

This has long been known as a risk, but the intriguing note in this report is that a 'factory reset' is insufficient to clear your private data on some Android phones. Wikipedia actually gets this wrong and claims "A factory reset should be performed with caution, as it destroys all data stored in the unit ".  However it also gets closer to the truth with "it is essentially the same concept as reformatting a hard drive". This does not remove the data from a hard drive, just 'hides' it from the operating system so that it can be over-written in due course. A factory reset on a smartphone will leave data on SD cards untouched.

With so many smartphones being recycled they are obviously highly vulnerable to the retrieval of passwords, personal data, banking credentials etc.

I remember writing some years ago that as mobile phones became more sophisticated we were in danger of repeating the same security mistakes as the PC era. This is just another example of that.

BT-backed 'Internet Matters' keeps children safe

BT and other major broadband providers have put aside their competitive differences to protect children in a joint initiative known as 'Internet Matters'.

Page Content

TV presenter Janet Ellis, and singer-songwriter daughter Sophie Ellis-Bextor, today launched Internet Matters to help children stay safe online. The site contains some simple things parents can do today, with a lot more tips and links to expert advice in their age guide pages.

 

Invaluable stuff.

Avoid Internet Explorer? Serious un-fixed vulnerability being exploited

Following the announcement on Saturday by Microsoft of a new remote code execution vulnerability, it tranpsires that, unsurprisingly, there are already active attempts by hackers to exploit it. If you click on a malicious website, or a website with a malicious advert or link, you are at risk. All Internet Explorer versions (6 to 11) are at risk for so-called 'drive-by' attacks.

The attack can give hackers the same user rights as the current user. So if you are logged in to your PC as an administrator the risk is compounded. As I point out in my book, it's best to use an admin account only where necessary, and certainly not for general web browsing.

Given that Microsoft is yet to issue a patch, a security update or a Fix it tool for closing the hole, one option being suggested is to avoid Internet Explorer.

Related articles

• U.S. government warns users to avoid Internet Explorer until security flaw fixed
• Microsoft Web Browser Security Bug Could Impact Millions of Users

Fake Android security app gets to top position

“Virus Shield” app became a top-selling hit, with the help of some presumably fake reviews – but does absolutely nothing. The app was apparently downloaded 10,000 times at $4 before the plug was pulled by Google. ESET have a good guide to spotting scammy apps - I particularly like the suggestion that when downloading you should think like you were shopping on eBay. And not blindly trusting 5* reviews is perhaps the hardest thought to overcome, conditioned as we are to check, and trust, reviews on sites like eBay.

UK Safer Internet Day - Today!

It's UK safer internet day today. Worth checking out the resources and quiz at the UK Safer Internet Centre website.

Fake LinkedIn Phishing Profiles - Highly Convincing

Knowbe4 report a very professional phishing attempt using a fake LinkedIn invitation. The fake profile that had been set up was very convincing. It was exposed by performing a 'reverse search' on the image of the person on their fake profile, and it turned out to be a stock image from a commercial website. Of course, in time the criminals will use a photo of someone who can't be traced so easily. Another angle would be to mimic the profile of people you might vaguely know, to encourage you to acept the fake invitation e.g. from someone in your company. A simple but potentially effective threat that just underlines the need to avoid clicking on links in emails.

Cyber to the Citizen

More sterling work to try and improve online security as the BCS teams with Get Safe Online to help educate communities on cyber security.

Are you cyber streetwise?

The new UK Government information site for Cyber Security awareness is worth checking out. 'Cyber Streetwise' is very well-crafted, somehow the way it invites you to meander through a cartoon-like street scene encourages you to click and read snippets of useful information about cyber security for small businesses and home users.

Secure your Passwords, and your digital legacy, with PasswordBox

Password management software company PasswordBox appears to have quickly spent some of its recent $6M funding on acquiring a complementary offering. 'Legacy Locker' is a digital afterlife service that – should you pass on without passing on your passwords – grants access to your online assets to friends and loved ones.

PasswordBox is another member of the important set of software that helps you manage your passwords. Definitely worth checking out.

Beware 'Ransomware' targeting UK computer users and SMEs

The UK's National Crime Agency (NCA) has warned of a 'significant risk' from emails with an attachment that, if launched, runs malware known as Cryptolocker. Cryptolocker encrypts the user’s files on the infected machine and demands payment to recover the data - an attack known as ransomware. The NCA points out that this spamming campaign is particularly targeting SMEs (presumably because of the type of message and fake attachment).

The usual advice to protect yourself applies including: ensure anti-virus is up to date; back up data; and don't open attachments if you have any doubts at all about their origin.

Beware phone calls claiming you have a problem with your computer

I popped home at lunch-time and the phone rang. I only heard a few words before I impolitely put the receiver down, cutting poor 'Alan' off in mid call-centre spiel. He claimed to be from the Global Security Department and his next sentence would have been to say they had found a problem with my PC and its internet connection. Very soon he would have wanted remote access to fix it but instead would have installed malicious software.

I noticed a story in a local paper just recently where a gentleman was nearly taken in by such a scam but managed to stop it just in time. And this isn't the first time I have received such a call. It behoves us all to spread the word about this dangerous practice.

10 Android Security Applications for Mobile Devices

Android has become a major target for malicious software - this eWEEK slide show covers 10 different security applications designed for Android 10 Android Security Applications to Keep Your Mobile Devices Safe. If you have an Android device you should be using something from this list.

Social media plagued by privacy problems, say researchers

Social media is plagued by privacy problems, according to researchers at Lancaster University who reviewed the privacy management of 16 popular social networking sites, including Facebook and Twitter. The interesting point in their work is that there is a disconnect between the published privacy policies and the options provided to users to control their privacy. I noted in my book that privacy controls on many sites are not obvious to the user. It now seems that what controls that do exist are not traceable back to the published privacy policies. I hope the research leads to a more transparent way for privacy permissions to be governed.

13 Million Facebook Users Haven't Touched Their Privacy Settings

Apparently 13 Million Facebook Users Haven't Touched Their Privacy Settings. And as I mention in my book, it's not in the interests of social media companies like Facebook, to have the defaults as private as you might like. So let's get that number down. Go and check your privacy settings now. If you are not sure how, go into the Facebook help centre, and click on 'Privacy'.

The Best Browser Extensions for Security and Privacy

A thorough article from Lifehacker - The Best Browser Extensions that Protect Your Privacy:
But note that some of these tools need to be used carefully as they can cause some browser hiccups.
In summary:

Block Ads, Scripts, and Popups with AdBlock Plus

Stop Everyone from Tracking You with Disconnect

In addition to privacy protecting tools and ad blockers, Lifehacker documents some other add-ons, utilities, and services worth considering if you have the other bases covered including:

HTTPS Everywhere (for Firefox/Chrome) which will try to find secure versions of the sites you visit.

And Hotspot Shield, Hideman, or Tunnelbear. for a Virtual Private Network or VPN. This encrypts all of your internet traffic.

The Best Antivirus App for Windows - from Lifehacker

The lifehacker website has changed its recommended anti-virus app for Windows. They recommend Avast Free Antivirus for the best balance between protection, ease of use, and cost. Their former favourite, Microsoft Security Essentials (also known as Windows Defender in Windows 8), has not been performing well enough in tests to keep its top ranking. For more information, see the lifehacker report The Best Antivirus App for Windows

Don't click on suspicious links - even in Skype messages

The usual warning is not to click on suspicious links in emails. Now an attack has been found where a compromised Skype account is used to send out a message containing a web link. If the link is clicked on, the user can be infected by some nasty malware which, apparently, are not detected by some anti-virus software. The Skype message is very simple - it contains just one goo.gl shortened link. So be careful with links on Skype - try to make sure there is a real person behind any message before you click.

App Security Provider MyPermissions Raises $1M in Funding

A company providing a service that allows users to police access to their personal data has raised $1million. The only surprise here is how little this is. By linking directly to application permission pages for services like Facebook, Twitter and Google, it alerts the consumer when an app access their personal data, giving them control over their personal information. Great idea. App Security Provider MyPermissions Secures $1M in Funding

Latest Advice on Browser Security Settings

The Veracode blog, 'All Things Security', has provided a useful set of security settings for 3 popular browsers: Google Chrome, Mozilla Firefox and MS Internet Explorer 10. It's interesting to see the 3 together and the different ways each has to control security and privacy. In Chrome you select 'Settings' and then click on 'Show Advanced Settings' - hidden at the bottom of the screen. In Firefox they are in the 'Options' menu under tabs 'Security' and 'Privacy'. In IE10 you click on Internet Options where there are tabs again for 'Security' and 'Privacy', but you also need to go to the 'Advanced' tab and scroll down to 'Security' there. Veracode have suggested turning off Javascript but this makes most sites unusable. As ever, security is a trade-off!