Author Archives: Graham Cluley

Privacy, risk and trolls: Dealing with the security challenges of YouTube fame

Posted on by

Interesting exploration by Joan Goodchild of CSO Online about the privacy issues facing YouTube vloggers:

Unlike television and movie stars, these online celebrities face a different kind of privacy challenge because, by nature of the work they do, they are expected to be accessible and to interact with fans.

Keeping things private and running a successful video log (vlog) are not exactly two compatible goals. This is because, according to LaToya Forever, an online personality with two popular vlogs on YouTube, one of the secrets of YouTube success is keeping things “100 percent real and genuine.” This means broadcasting everything from adorable kid moments to family drama for the world to see.

“Sometimes it’s hard to wade through and decide what to share and what not to share,” said Nikki Phillipi, a lifestyle vlogger with over a million subscribers.

I understand the appeal to many of watching vloggers who are sharing their personal lives in a “100% real and genuine” fashion, but how on earth can they hope to balance such a lifestyle with privacy?

Read more on CSO Online.

Continue reading Privacy, risk and trolls: Dealing with the security challenges of YouTube fame→

Let’s Encrypt and Comodo in trademark tussle

Posted on by

The non-profit Let’s Encrypt project, set up to help more websites switch on HTTPS for free, has found itself in a kerfuffle with Comodo, one of the largest commercial vendors of website certificates.

Let’s Encrypt writes:

Some months ago, it came to our attention that Comodo Group, Inc., is attempting to register at least three trademarks for the term “Let’s Encrypt,” for a variety of CA-related services. These trademark applications were filed long after the Internet Security Research Group (ISRG) started using the name Let’s Encrypt publicly in November of 2014, and despite the fact Comodo’s “intent to use” trademark filings acknowledge that it has never used “Let’s Encrypt” as a brand.

…

Since March of 2016 we have repeatedly asked Comodo to abandon their “Let’s Encrypt” applications, directly and through our attorneys, but they have refused to do so. We are clearly the first and senior user of “Let’s Encrypt” in relation to Internet security, including SSL/TLS certificates – both in terms of length of use and in terms of the widespread public association of that brand with our organization.

Comodo, which claims to be the world’s most widely used SSL Certificate Authority, wants to trademark “Let’s Encrypt”, “Let’s Encrypt with Comodo” and “Comodo Let’s Encrypt.”

Things are getting ugly… and I can’t see how this is going to help create a more secure internet.

Continue reading Let’s Encrypt and Comodo in trademark tussle→

Security holes found in widely-used file compression library, leaving other products dangerously exposed

Posted on by

Researchers have called for users to patch and upgrade their vulnerable software as soon as possible, after three severe vulnerabilities were found in libarchive, a widely-used open source compression library.
Read more in my article on the Tripwire St… Continue reading Security holes found in widely-used file compression library, leaving other products dangerously exposed→

154 million voter records exposed, revealing gun ownership, Facebook profiles, and more

Posted on by

Security researcher Chris Vickery came across an online database, hosted on a Google Cloud server, containing 154 million US voter records.
It emerged that the poorly-secured database belonged to an unnamed client of data brokerage firm L2. The client… Continue reading 154 million voter records exposed, revealing gun ownership, Facebook profiles, and more→

Security Holes Found in Widely-Used File Compression Library, Leaving Other Products Dangerously Exposed

Posted on by

Researchers have called for users to patch and upgrade their vulnerable software as soon as possible, after three severe vulnerabilities were found in libarchive, a widely-used open source compression library.
The post Security Holes Found in Widely-Us… Continue reading Security Holes Found in Widely-Used File Compression Library, Leaving Other Products Dangerously Exposed→

⊛ CEO salaries should be linked to their firm’s cyber security, says UK parliament

Posted on by

Should the salaries of CEOs be linked to how well their company has protected itself against security threats?
British MPs certainly seem to think so.
Read more in my article on the Bitdefender Business Insights blog.
Continue reading ⊛ CEO salaries should be linked to their firm’s cyber security, says UK parliament→

Monsanto sues ex-employee accused of stealing data

Posted on by

Controversial agriculture and biotech giant Monsanto has filed a lawsuit against former employee Jiunn-Ren Chen, accusing him of stealing 52 files from its computer systems.

Chen, who worked as a programmer for Monsanto, is said to have accessed sensitive information nine days after he told the firm that he was resigning, reports Jacob Bunge at the WSJ:

Mr. Chen told Monsanto on June 1 that he was resigning and planned to return to Taiwan to care for his sick father and take over the family business there, according to the lawsuit. That same day, he turned over his company-issued computers, which Monsanto officials analyzed as per company policy. The analysis showed Mr. Chen’s computers contained “highly sophisticated and unauthorized software” that could be used to monitor activity and siphon away data, according to the suit.

While monitoring activity around Mr. Chen’s access credentials, Monsanto discovered that on June 10, his credentials were used to remove files from Monsanto’s systems, the company said. His last official day of work was expected to be June 14, the lawsuit says.

When Monsanto asked Mr. Chen about the removed files, he attributed it to a “hacker” but also said he was considering a job offer at a seed company based in Wuhan, China, court papers said. According to the lawsuit, he said he had previously been in contact with Mo Hailong, a Chinese citizen who earlier this year pleaded guilty to participating in a long-running plot to steal genetically pure corn seeds developed by Monsanto and DuPont Co.

The WSJ reports that Monsanto is also keen to access and rifle through Chen’s “cloud data storage accounts”, to see if any other company data might be stored there.

Moral of the story? Have a clear policy of revoking access rights to sensitive information when workers are in the process of leaving your business.

Monsanto, the world’s largest producer of genetically modified seeds, has stirred worldwide protests for its successful lobbying against the mandatory labelling of food containing genetically modified organisms (GMOs), and is no stranger to security breaches and hacking attacks.

Continue reading Monsanto sues ex-employee accused of stealing data→

⊛ Get FREE threat intelligence on hackers and exploits with the Recorded Future Cyber Daily

Posted on by
Get trending info on hackers, exploits, and vulnerabilities every day for FREE with the Recorded Future Cyber Daily [Sponsor]

Many thanks to the great folks at Recorded Future, who are sponsoring my writing this week.

Recorded Future provides deep, detailed insight into emerging threats by automatically collecting, analyzing, and organizing billions of data points from the Web.

And now, with its FREE Cyber Daily email all IT security professionals can access information about the top trending threat indicators – helping you use threat intelligence to help make better decisions quickly and easily.

Which means that you will be able to benefit from a daily update of the following:

  • Information Security Headlines: Top trending news stories.
  • Top Targeted Industries: Companies targeted by cyber attacks, grouped by their industries.
  • Top Hackers: Organizations and people recognized as hackers by Recorded Future.
  • Top Exploited Vulnerabilities: Identified vulnerabilities with language indicating malcode activity. These language indicators range from security research (“reverse engineering,” “proof of concept”) to malicious exploitation (“exploited in the wild,” “weaponized”).
  • Top Vulnerabilities: Identified vulnerabilities that generated significant amounts of event reporting, useful for general vulnerability management.

Infosec professionals agree that the Cyber Daily is an essential tool:

“I look forward to the Cyber Daily update email every morning to start my day. It’s timely and exact, with a quick overview of emerging threats and vulnerabilities. For organizations looking to strengthen their security program with threat intelligence, Recorded Future’s Cyber Daily is the perfect first step that helps to prioritize security actions.” – Tom Doyle, CIO at EBI Consulting.

So, what are you waiting for?

Sign up for the Cyber Daily today, and starting tomorrow you’ll receive the top trending threat indicators.

If you’re interested in exclusively sponsoring my site for a week, and reaching an IT-savvy audience that cares about computer security, you can find more information here.

Continue reading ⊛ Get FREE threat intelligence on hackers and exploits with the Recorded Future Cyber Daily→