Consumer Reports launches new privacy and data security standard

Consumer Reports has announced it is to launch the first phase of a collaborative effort to set up a new standard for digital security for consumers, in an attempt to boost consumer confidence in privacy and data security.

The new initiative will aim to bring out the positive aspects of previous similar schemes, and will be carried out in conjunction with several partners within the industry.

Safeguarding the security and privacy of consumers will be the end goal of the new measures.

The US-based nonprofit organization hopeful that the industry will adopt the standard in the development of various digital products, including connected devices, software and mobile apps.

The aims of the new standard include ensuring all products, whether they are laptops, security cameras or even cars, are built with the robustness needed to withstand security threats.

The standard will also aim to inform consumers about what data is being collected by their products, while at the same time offering more clarity when it comes to the idea of ownership.

Ethical behavior is another central theme to Consumer Reports goals, with transparency being touted as a key element for ensuring customer satisfaction and enhancing confidence among consumers.

The first draft of the proposal has been placed on GitHub, a website that holds tremendous popularity with many software developers.

Consumer Reports hopes that concerned parties will make necessary contributions that will help to refine and improve the standard.

The success of the measures remains to be seen, but protecting data in the age of connected products is still a pressing concern within the industry.

The beginning of the month saw the range of CloudPet toys criticized for an alleged inability to keep personal and private pieces of data away from the threat of cybercriminals.

IoT of toys stranger than fiction: Cybersecurity and data privacy update

By Stephen Cobb

Privacy breaches and cybersecurity failures are becoming – it pains me to say – all too commonplace. However, that doesn’t mean some of them are not uncommonly strange, involving circumstances so odd they are almost unbelievable. Consider the following tale of two images (which may be worth more than two thousand words for the pair).

First, consider the striking image on the left, created last year by ESET for an infographic about the Internet of Things or IoT. In the picture you can see a bunch of different “things” that could potentially be connected to the internet, from an automobile to home appliances, from wearable devices to a teddy bear (and if you think this particular teddy looks a little sinister, that’s thanks to the skill of this particular artist). 

The infographic itself, to which there is a link at the end of this article, display the results of a survey that ESET carried out last October in conjunction with the National Cyber Security Alliance. The goal was to assess consumer attitudes to the IoT (as you may know, October is National Cybersecurity Awareness Month). Because the survey results were published later in the month, close to Halloween, and the science fiction-horror series Stranger Things had become quite popular, ESET thought that “Internet of Stranger Things” would be a nice twist to put into the title of the resulting infographic (hence teddy’s intentionally sinister look).

Now checkout the image on the right. This is an actual toy, sold in America, that connects to the internet, namely a CloudPet (a brand owned by California-based Spiral Toys). This toy, which can record, send, and receive voice messages over the internet, has been in the news lately, but for all the wrong reasons.

First, there are the hundreds of thousands of customer records found stored on the web in a way that exposed them to anyone curious enough to look for them. Then there are the two million recorded voice messages, often very personal messages between children and parents, that were exposed for an extended period of time to anyone with basic skills, despite numerous warnings to the company about this problem. Here is how security researcher Troy Hunt put it in his lengthy but truly excellent blog post:

“By now it’s pretty obvious that multiple parties identified the exposed database, it remained open for a long period of time and it exposed some very personal data. It would be a safe bet to assume that many other parties located and then exfiltrated the same data because that’s what people do; scanning for this sort of thing is enormously prevalent and that data – including the kids’ and parents’ intimate audio clips – is now in the hands of an untold number of people.”

That is Troy’s emphasis, and he goes on to say “But it gets worse again” because not only was data from the toys and their owners badly handled and poorly protected by a company that did not respond to multiple warnings that this was indeed the case, but as his research shows: “CloudPets data was accessed many times by unauthorized parties before being deleted and then on multiple occasions, held for ransom.”

And if you were thinking this could not get even worse, and truly scary like the teddy bear in the “stranger things” graphic, you’d be wrong, as I will explain in a moment. But first consider this finding from the ESET/NCSA survey: “more than 40 percent of Americans are not confident that IoT devices are safe and secure, with more than half of people indicating they were discouraged from purchasing an IoT device due to cybersecurity.” More specifically the survey found: “36 percent of respondents were very concerned about the privacy and security of children that use ‘smart-toys’.”

In other words, companies who are making internet connected devices are already on notice that there is skepticism and concern about their security and the privacy of personal information that they process. We have seen poor security affecting connected toys before, as in the VTech case. I have previously written about security risks related to wearables and connected/autonomous vehicles. And to say that voice-activated connected devices may cause unexpected side effects is clearly an understatement.

What ties all of these things together – besides the internet – is the fact that too many people who make technology are also making poor decisions about technology risks. Those poor decisions lead to problems, not just for the unwitting consumers that buy the poorly secured products, but also for the wider digital ecosystem. Consider the massive Distributed Denial of Service (DDoS) attack on October 21 of last year. That resulted in lost revenue and unbudgeted costs for hundreds of companies, and it was made possible by insecure IoT devices. How long before an attack of this type impacts patient care in the increasingly connected medical world of electronic health records?

And when you hear about devices giving up the secrets of their users like these cuddly toys did, you have to ask how long before patient fears around privacy loss due to weak security lead to the rejection of connected monitoring and treatment devices, undermining the much anticipated benefits of telemedicine? That day may come sooner than you think, because as I said, the CloudPets story gets worse. It turns out that, due to design flaws and poor risk assessment, these things can be turned into spying devices, as described in this article and also here. While you could say “they’re just toys,” it is not hard to see that a string of cases like this could seriously undermine the public’s faith in more critical digital technology, an outcome with potentially dire economic consequences.

http://www.welivesecurity.com/2017/03/03/internet-of-things-security-privacy-iot-update/?utm_source=feedburner&utm_medium=email&utm_campaign=Feed%3A+eset%2Fblog+%28ESET+Blog%3A+We+Live+Security%29

10 ways to ruin a cybercriminal’s day

By Lucas Paus

Technology has changed the way we live, our relationships with others, and even how we take care of ourselves. These days, everyone – from the most inexperienced to the most advanced user – takes measures to protect themselves from cybercriminals seeking to compromise or steal information.

In this article, we discuss how you can fend off cybercriminals’ malicious attacks, making it much more difficult for them to succeed. 

1. Update your security solution, applications, and operating system

This is of vital importance, as software updates often include solutions to security defects that have been found. This way, if your system or application has any flaws, they will be resolved by the updates, meaning an attacker will not be able to exploit any kind of known vulnerability in your system.

2. Install security solutions on your devices

Computers, smartphones, tablets and any other devices that allow security software to be installed should be protected. It is important not to use pirated software because, besides being illegal, it is unlikely to offer proper protection.

Tools like firewalls and antivirus software will defend you from various threats, including Trojans and other types of malware, as well through various detection technologies, which help prevent leaks or information theft.

3. Make backups

As well as making backup copies regularly, you should ensure that they are kept in a safe place: putting them on an external drive should be sufficient. Be sure not to leave them constantly connected, because if your computer becomes infected with any kind of ransomware, your backup files could become encrypted too, even if they are stored in the cloud.

If your computer becomes infected and you have kept your backup in a safe place, you will easily be able to restore your information after you disinfect your system.

For more information, see our backup guide.

4. Report phishing emails and websites

One of the most frequently used methods for carrying out fraud is the old trick of setting up fake websites. Receiving an email from a sender that looks familiar, with a link that directs you to a fake portal, is a technique often employed by cybercriminals.

To prevent this from happening, it is very important to report phishing websites from whichever browser you are using, and also report them to your antivirus provider if it does not already recognize the site as a malicious portal.

“One of the most frequently used methods for carrying out fraud is the old trick of setting up fake websites.”

If the phishing website is a financial one, you could get in touch with the organization affected so they can start the process of getting rid of it. This way, you will be helping to protect the community by warning people about the dangers of visiting fake sites. Naturally, we do our bit at the ESET LATAM Research Lab by reporting the cases we receive.

5. Change your passwords

There are many ways in which your password can be compromised. Make sure you have a strong password, change it regularly, and don’t use the same one for multiple accounts.

These three pillars will help keep the key to your digital identity secure.

6. Activate two-factor authentication

Even if you follow each of these recommended practices to protect your passwords, they could still become compromised. However, two-factor authentication, which is available on most social networks and online services, will significantly increase your levels of security.

If a cybercriminal manages to steal your password, they will not be able to do any significant damage, as they will still need to input a code generated by this additional layer of security.

7. Check the privacy of your social networks

All too often we’ve seen users sharing an excessive amount of sensitive information on social networks.

“Platforms like Facebook allow you to set up groups where you can share information and  limit who views it.”

This problem is exacerbated if their posts are public. Platforms like Facebook allow you to set up groups where you can share information and  limit who views it.

It is also important not to grant access to users you don’t know and to review the permissions that you have in place around your personal information.

8. Check the status of your bank accounts

You can never check your balance too often, as by doing so you may detect an irregularity or unknown transaction. If your card has been cloned or you have fallen victim to banking malware, regularly checking your account is the best way for you to keep tabs on any attacks that may have happened – and minimize the damage.

9. Make sure you aren’t subscribed to any premium SMS services

The number of hoaxes circulating on WhatsApp continues to increase, with one single campaign having the ability to yield more than 10 million victims. This often ends up with users being caught off guard and subscribing to numbers that send SMS messages which charge the recipient a fee to receive them.

To prevent this, many countries allow you to check whether you are subscribed to any such services on your phone provider’s website.

10. Be aware of your environment

Understanding how hoaxes work is the best way to avoid falling victim to one. At the same time, sharing your knowledge will make you a friend of IT security; and by protecting the devices of other people who use the same network as you, you will also be taking care of your own property and the information stored on your computer.

Undoubtedly, if you follow these tips, you will be able to increase the security of your devices and create obstacles for cybercriminals, which in most cases will prevent attacks, as increasing the complexity of these operations will most likely put them off attempting them.