Read Time:1 Second
Post Content
Monthly Archives: January 2022
FreeBSD-EN-22:06.libalias
FreeBSD-EN-22:02.xsave
Free guide: “A Journey to Zero Trust With Zero Passwords”
Read Time:20 Second
Graham Cluley Security News is sponsored this week by the folks at HYPR. Thanks to the great team there for their support! A new guide by the analysts at The Cyber Hut looks at how Zero Trust increases business agility and provides practical guidance for eliminating passwords to accelerate your Zero Trust strategy. Passwordless MFA … Continue reading “Free guide: “A Journey to Zero Trust With Zero Passwords””
Multi-Factor is incomplete without backup codes
Read Time:2 Minute, 42 Second
This blog was written by an independent guest blogger.
I was logging into one of my favorite online shopping sites the other day, and, as with all my other sites, I was presented with the multi-factor authentication prompt to complete the login process. Anyone who knows me, knows that I have been a long-time supporter of multi-factor, or 2-step verification of any kind.
The only problem I had with the login on this occasion, was that my phone was dead. Like most folks, my phone contains the authenticator applications that allow me to log into most of the sites that do not allow the use of a FIDO hardware token. This created an unusual conundrum, whereas, not only does my phone contain the authenticator application, but the only backup method the site offers is to send a text message to a registered phone number if the authenticator application is unavailable. The problem is that the registered phone number is attached to the same dead phone that contains the authenticator application.
Usually, this is not a problem, as most sites that have fully thought through their implementation of multi-factor authentication have also considered the problem of the lost, or otherwise non-functioning phone, and they issue one-time codes when the 2FA process is first enabled. These codes can be stored in a safe place.
Recently, when Google announced to a select group of GMail users that their mail account will be forced to use multi-factor authentication, many people protested. While I can understand the shock that many felt at the imposition of an unsolicited change to the login process, I commended the fact that steps were being taken to protect these vulnerable accounts. Google also did everything right, that is, they gave people multiple options to verify the log in process, including one-time backup codes to be used if the authenticating device is unavailable.
Many people who dislike multi-factor will lament at the thought of also having to store what amounts to other passwords, as one-time codes can arguably be thought of as just another password. This is where a password manager can serve double-duty to assist the password-weary.
Most password managers offer text fields that often go ignored and unused. However, that big open space can be used to store a ton of useful information. For example, the one-time codes can be stored there, in addition to the random answers to the common security questions asked by many sites.
None of what I am positing here should be misinterpreted to think that I am against multi-factor authentication in any way. Until passwordless technology replaces the current methods, I will remain committed to supporting 2FA as the best method we have right now. In the meantime, the problem that needs to be addressed is how to get more sites to fully realize their multi-factor implementations, and offer one-time codes along with whatever other methods they use for their enhanced security options. One has to wonder why this was overlooked in the first place? Until these solutions are established, I suppose I need to be more diligent about keeping my phone charged. Happy shopping!
500M Avira Antivirus Users Introduced to Cryptomining
Read Time:3 Minute, 34 Second
Many readers were surprised to learn recently that the popular Norton 360 antivirus suite now ships with a program which lets customers make money mining virtual currency. But Norton 360 isn’t alone in this dubious endeavor: Avira antivirus — which has built a base of 500 million users worldwide largely by making the product free — was recently bought by the same company that owns Norton 360 and is introducing its customers to a service called Avira Crypto.
Avira Crypto
Founded in 2006, Avira Operations GmbH & Co. KG is a German multinational software company best known for their Avira Free Security (a.k.a. Avira Free Antivirus). In January 2021, Avira was acquired by Tempe, Ariz.-based NortonLifeLock Inc., the same company that now owns Norton 360.
In 2017, the identity theft protection company LifeLock was acquired by Symantec Corp., which was renamed to NortonLifeLock in 2019. LifeLock is now included in the Norton 360 service; Avira offers users a similar service called Breach Monitor.
Like Norton 360, Avira comes with a cryptominer already installed, but customers have to opt in to using the service that powers it. Avira’s FAQ on its cryptomining service is somewhat sparse. For example, it doesn’t specify how much NortonLifeLock gets out of the deal (NortonLifeLock keeps 15 percent of any cryptocurrency mined by Norton Crypto).
“Avira Crypto allows you to use your computer’s idle time to mine the cryptocurrency Ethereum (ETH),” the FAQ explains. “Since cryptomining requires a high level of processing power, it is not suitable for users with an average computer. Even with compatible hardware, mining cryptocurrencies on your own can be less rewarding. Your best option is to join a mining pool that shares their computer power to improve their chance of mining cryptocurrency. The rewards are then distributed evenly to all members in the pool.”
NortonLifeLock hasn’t yet responded to requests for comment, so it’s unclear whether Avira uses the same cryptomining code as Norton Crypto. But there are clues that suggest that’s the case. NortonLifeLock announced Avira Crypto in late October 2021, but multiple other antivirus products have flagged Avira’s installer as malicious or unsafe for including a cryptominer as far back as Sept. 9, 2021.
Avira was detected as potentially unsafe for including a cryptominer back in Sept. 2021. Image: Virustotal.com.
The above screenshot was taken on Virustotal.com, a service owned by Google that scans submitted files against dozens of antivirus products. The detection report pictured was found by searching Virustotal for “ANvOptimusEnablementCuda,” a function included in the Norton Crypto mining component “Ncrypt.exe.”
Some longtime Norton customers took to NortonLifeLock’s online forum to express horror at the prospect of their antivirus product installing coin-mining software, regardless of whether the mining service was turned off by default.
“Norton should be DETECTING and killing off crypto mining hijacking, not installing their own,” reads a Dec. 28 thread on Norton’s forum titled “Absolutely furious.”
Others have charged that the crypto offering will end up costing customers more in electricity bills than they can ever hope to gain from letting their antivirus mine ETH. What’s more, there are hefty fees involved in moving any ETH mined by Norton or Avira Crypto to an account that the user can cash out, and many users apparently don’t understand they can’t cash out until they at least earn enough ETH to cover the fees.
In August 2021, NortonLifeLock said it had reached an agreement to acquire Avast, another longtime free antivirus product that also claims to have around 500 million users. It remains to be seen whether Avast Crypto will be the next brilliant offering from NortonLifeLock.
As mentioned in this week’s story on Norton Crypto, I get that participation in these cryptomining schemes is voluntary, but much of that ultimately hinges on how these crypto programs are pitched and whether users really understand what they’re doing when they enable them. But what bugs me most is they will be introducing hundreds of millions of perhaps less savvy Internet users to the world of cryptocurrency, which comes with its own set of unique security and privacy challenges that require users to “level up” their personal security practices in fairly significant ways.
The Spine Collector: Man arrested for using fake email addresses to steal hundreds of unpublished manuscripts
Read Time:9 Second
For years, “The Spine Collector” has been haunting publishers around the world, attempting to steal manuscripts by famous authors.
Read more in my article on the Hot for Security blog.
Attack misuses Google Docs comments to spew out “massive wave” of malicious links
Read Time:12 Second
Security researchers say they have seen a “massive wave” of hackers exploiting the comment feature in Google Docs to spread malicious content into the inboxes of unsuspecting targeted users.
Read more in my article on the Tripwire State of Security blog.
Multiple Vulnerabilities in Google Android OS Could Allow for Remote Code Execution
Read Time:38 Second
Multiple vulnerabilities have been discovered in the Google Android operating system (OS), the most severe of which could allow for remote code execution. Android is an operating system developed by Google for mobile devices, including, but not limited to, smartphones, tablets, and watches. Successful exploitation of the most severe of these vulnerabilities could allow for remote code execution within the context of a privileged process. Depending on the privileges associated with this application, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. If this application has been configured to have fewer user rights on the system, exploitation of the most severe of these vulnerabilities could have less impact than if it was configured with administrative rights.
Multiple Vulnerabilities in Google Chrome Could Allow for Remote Code Execution
Read Time:31 Second
Multiple vulnerabilities have been discovered in Google Chrome, the most severe of which could allow for remote code execution. Google Chrome is a web browser used to access the Internet. Successful exploitation of the most severe of these vulnerabilities could allow an attacker to execute arbitrary code in the context of the browser. Depending on the privileges associated with the application, an attacker could view, change, or delete data. If this application has been configured to have fewer user rights on the system, exploitation of the most severe of these vulnerabilities could have less impact than if it was configured with administrative rights.