Facebook now lets parents monitor their children’s chats

The feature is part of expanded parental controls on the Messenger Kids app aimed at children under 13

Tomáš Foltýn

Facebook is rolling out a slew of changes to Messenger Kids that give parents more control over how their children use the messaging app. You can review who your kids are interacting with and review their chat histories, according to the social network’s blog post this week.

In addition, you get access to the most recent videos and photos your kids have sent or received, and you can remove the content if needed. The app’s revamp also gives you the option to see a list of devices where your children are logged in, and force a log-out remotely.

“Parents remain in control of who their child is connected to in Messenger Kids and can remove people from their child’s contact list at any time,” said Facebook product manager Morgan Brown. The new features can be accessed through the Messenger Kids Parent Dashboard in the Facebook Android and iOS apps.

You can also request a copy of your child’s Messenger Kids data, much like you can do with your own information shared with Facebook. “The download will include a list of your child’s contacts as well as the messages, images and videos they have sent and received. Your child will be notified through the Messenger Kids app when you request this information,” said Brown.

Facebook has also made it easier for kids to block contacts and overall manage who they interact with. As a parent or guardian, you can now also see if your child has reported or blocked, as well as unblocked, other users.

In addition to rolling out the new features, Facebook announced an update to its privacy policy to add extra information about “data collection, use, sharing, retention and deletion practices”.

The company said it would use age-appropriate language to educate children on data collection. “For example, we inform kids that people they know may see their name and photo, that parents can see and download their messaging content and that they are not able to delete any messages they send or receive,” said Facebook.

The social giant has previously given assurances regarding the use of collected data and was quick to reiterate its promise again: “We don’t use children’s data from Messenger Kids for advertising. There continue to be no ads in Messenger Kids and no in-app purchases.”

Geared towards children younger than 13 years, Messenger Kids is designed to be a controlled-environment alternative to the social network’s main Messenger app. The kid-friendly app was launched for iOS devices in the United States in December 2017; other countries and the Android version followed a few months later.

The app gives children a way to stay in touch with their relatives and friends while giving parents some measure of oversight, including by allowing them to pre-approve the list of people their kids interact with.

Facebook came under fire last year after a design flaw in the app undermined these parental controls by allowing some of the app’s users to chat with complete strangers.

https://www.welivesecurity.com/2020/02/06/facebook-now-lets-monitor-childrens-chats/?utm_source=feedburner&utm_medium=email&utm_campaign=Feed%3A+eset%2Fblog+%28ESET+Blog%3A+We+Live+Security%29

AV-Comparatives beloont ESET’s consumentenproducten met gouden medailles in cybersecurity awards

ESET, een wereldleider in cybersecurity, werd in het AV-Comparatives Summary Report 2019 beloond met gouden en bronzen onderscheidingen. AV-Comparatives, een toonaangevende onafhankelijke testorganisatie, gebruikt een van de grootste samplecollecties ter wereld om een realistische omgeving te creëren voor uiterst nauwkeurige testen.

Het Summary Report 2019 bespreekt de antivirusproducten voor consumenten die in de loop van het jaar getest werden en zet de hoog scorende producten van de verschillende tests van de afgelopen 12 maanden in de schijnwerpers.

Het rapport onderzocht consumentenproducten voor Windows, van 16 verschillende leveranciers. ESET behaalde uitstekende resultaten en onderscheidingen in drie categorieën: Globale Prestaties (lage systeemimpact), Verbeterde Realistische Test (geavanceerde bedreigingsbescherming) en de False Positive Test.

Globale Prestaties (lage systeemimpact)

ESET kreeg een gouden medaille in de categorie lage systeemimpact, AV-Comparatives die de impact van elk product op snelheid en prestaties van het systeem beoordeelt. ESET heeft in deze categorie altijd uitstekende resultaten behaald en kon zo zijn zilverprijs uit 2018 in dezelfde categorie verbeteren.

Verbeterde Realistische Test (geavanceerde bedreigingsbescherming)

ESET werd eveneens beloond met een gouden medaille in de categorie geavanceerde bedreigingsbescherming (Advanced Threat Protection). Dit is een nieuwe categorie voor 2019 en 2020. Deze test onderzoekt het vermogen van een programma om tegen geavanceerde gerichte en bestandloze aanvallen te beschermen. ESET was ook een van de slechts twee leveranciers die, in het testproces, erin slaagde de 15 gerichte aanvallen te blokkeren.

Test op Valse Positieven (False Positive Test)

ESET kreeg een bronzen medaille in de False Positive Test. Zoals in het rapport vermeld staat, kunnen valse positieven evenveel problemen veroorzaken als een echte infectie. Deze vermijden is dus een cruciaal element van elk antivirusproduct. AV-Comparatives voerde uitgebreide testen op valse positieven als onderdeel van de beschermingstests voor malware en de Verbeterde Realistische Test (Real-World Protection Test).

In een reactie op de resultaten zei Jiří Kropáč, hoofd van de labo’s voor detectie van bedreigingen bij ESET: “De erkenning van ESET door AV-Comparatives bewijst onze toewijding aan onze klanten en onze inzet om in IT-beveiligingsoplossingen altijd het beste te leveren. Ervoor zorgen dat consumenten kunnen beschikken over geavanceerde beveiliging tegen de nieuwste bedreigingen is voor ons van het grootste belang. We zijn vereerd deze prijzen te mogen ontvangen en erkend te worden als een belangrijke speler in het veiliger maken van technologie voor iedereen. "

Voor meer informatie, lees https://www.av-comparatives.org/tests/summary-report-2019/  

---

 [A1]Link report if possible

How to catch a cybercriminal: tales from the digital forensics lab

Jake Moore

What is it like to defeat cybercrime? A peek into how computer forensics professionals help bring cybercriminals to justice.

Many people ask me about what it was like working for law enforcement. More often than not, however, they are actually enquiring about how computer crime is truly investigated. Whether it’s questions about how accurately it is portrayed on TV, the constraints felt by the police, the associated myths, or about how to find closely guarded tactics and secrets, people seem to have a morbid fascination with the dark world of digital forensics.

Before joining ESET, for nearly a decade I was a computer forensics examiner for the UK police. My job was to perform deep forensic analysis of computers, hard drives, phones and other devices that had been instrumental in crimes, including murder, child abuse and fraud. With some of the best forensic tools at my disposal, I delved not only into these devices but, metaphorically, into the lives of the suspects who had been locked up or released on bail. Performing such an analysis could take anything from a day to a few months, depending on what was required, the state and security of the storage medium, or more importantly, the magnitude of the case.

From being able to locate a suspect’s Google search history, their photo galleries, their online chats, and even their deleted items, once I was into the devices, I was able to see a lot more than just the data on the drives. Going through a person’s computer or phone is like going through their minds – it is intense. And people would ask me things like, “is it just like in the movies?” or, “can you really get something back that I have deleted”?

Well, “yes and no” is the real answer to both these questions. It’s never as quick as in the movies, but most of what you see is usually possible – just not for every case. Deleted files can be retrieved so long as they haven’t been overwritten. When deleting any data, it is effectively like ripping the contents page out of a book – the information is still there, you just don’t know what page it’s on.

Constraints

As well as difficulties coming in the form of increasing dark web activity causing a headache for the police, the real constraint in the lab came in the form of full-disk encryption. It is the biggest hurdle for computer examiners and there are only a few measures to overcome it. First there is the National Technical Assistance Centre (NTAC), part of the UK’s GCHQ, which would be on hand to brute-force encrypted drives for the police. This could take any length of time depending on the passcode. However, they had an incredible success rate with the computer power behind them. It would always be magical to be handed back a hard drive of previously encrypted contents with now full access after a suspect has gone no comment or, better still, a suspect who would say that we wouldn’t find anything illegal.

Usually, locked phones were never a problem, though. Typically, they could be unlocked in-house with the best law enforcement-supplied software, which the UK police still use. This was made easier on phones that were not immediately updated to the latest operating system.

The darker side of digital forensics

No job comes without its downsides but being able to see absolutely any sort of material on a device comes with damaging side effects to anyone. Luckily, anyone working in police digital forensics is given counseling every 6 months. This is essential for anyone who comes in contact with suspect devices and certain life-affecting material. Some people can have repulsive and horrific images or videos on their devices and this needs to be addressed by anyone who witnesses it. Although in my job I could potentially see anything, I was there to locate the evidence before a specialist team, the Paedophile OnLine Investigation Team (POLIT), would grade any indecent material into a subrange of categories. The worst material located would naturally give harsher sentences, but it would be down to the courts to determine jail time. This was a disturbing, yet vital, part of the process that, in turn, would put damaged individuals away from further offending.

Related reading: What makes a cybercriminal?

I was once called to help investigate a murder where the Major Crime Team already had a wealth of evidence but like in most murders or suspicious deaths, there was digital evidence that required forensic examination. After receiving a blood-stained laptop, I made a digital copy (image) of the hard drive and delved into what was going on in the log files near to when the alleged offence occurred. I did not expect to find anything, let alone that the suspect had Googled “how do I get rid of a dead body” just after the offense occurred. Of course, anyone could have Googled that, right?

I was regularly called to court to discuss the digital evidence I had uncovered in a whole range of cases. In 2014 I was summoned to court for a case of possession of indecent images. The defendant had gone “no comment” to all prior questions during interrogation and then entered a not guilty plea. However, by just turning up as a professional witness with my digital forensic experience, he pleaded guilty based on the evidence I presented to the judge, jury and defense team. The defense would wait to see what evidence the prosecution could produce. Indeed, they would even attempt to attack or plead guilty only once they knew a digital forensic examiner had solid unquestionable evidence beyond reasonable doubt for the jury. In this particular case, I had his complete Google search history dating back many years, not to mention his vast collection of indecent images in an encrypted folder that I was able to extract and show the judge.

Sentencing

Many convicted criminals were given no prison time or only short sentences for some offenses which, in the public’s eye, didn’t match up with the crime being tried. The law enforcement’s job is to deliver the best evidence available and help show that a defendant is guilty. The Crown Prosecution Service, CPS, is the governing body that delivers the sentence. But what would get a suspect off? This is the job of the defense and they were very good at it.

Typically, the defense lawyer would wait to see all the evidence that the prosecution has to offer and then try to attack it where possible. Such attacks could be on witness statements or better still, via an independent computer forensic examiner working for the defense in order to try to muddy the evidence.

A typical answer to an offense would be the “Trojan defense”, where the suspect would claim he or she had no idea what was on the device and it must have been the work of malware. It would sometimes take a lot of work to disprove this particular counterargument. In some cases, this would even halt the court process altogether until I would have time to work back on the forensic image and prove otherwise.

Whilst preparing for court, I was given intense court training by an incredible lawyer who works for both prosecution and defense. He taught me the strengths and weaknesses a trial faces day in, day out and the tactics used to try to win or dismiss a court case. I was shown the tricks a lawyer could use as well as learning where to admit defeat. Such tricks to gain an acquittal are still used in English court rooms today.

In the UK, the judge will usually want a unanimous vote (12-0) or a majority vote (11-1 or 10-2) beyond reasonable doubt to convict the defendant. This therefore opens the fact that the defense lawyer need only overturn 3 jurors to get his or her way and gain a hung jury, which may or may not in turn lead to a retrial. This can be accomplished using psychology, manipulation and skill and using such tactics as getting the jurors on the defense’s side, and to then agree with the defense.

Why do it?

So why do digital forensic examiners do what they do? Because what they perform helps put criminals away and without such forensic evidence, most cases would struggle with classic CSI evidence alone such as fingerprints, etc. Forensic CSI examiners do a fabulous job, but evaluation of digital evidence is growing in police forces across the globe and is stretching police funding more than ever. There are more digital devices coming in than the police can deal with and backlogs are increasing daily – some jobs can take well over 12 months to be examined.

Am I glad to be out of it? This is another question I receive a lot of the time and to be honest, I miss the community within the police, which is like a family. What I don’t miss is the “not guilty” outcomes on cases where I was sure they should be different. Nor do I miss the constraints around encryption and dark web usage increasing, and I now get job satisfaction from helping people and businesses protect themselves against cyberattacks.

Additional reading

While the following is not strictly related to the work of computer forensics experts, law enforcement worldwide has, over the years, requested the assistance of ESET security researchers in helping crack down on several large-scale cybercriminal operations. The researchers’ technical analyses have been instrumental in disrupting a number of such criminal rings, including the 3ve online ad fraud operation and the Gamarue botnet.

Electric scooters vulnerable to remote hacks

A helmet may not be enough to keep you safe(r) while riding an e-scooter

Amer Owaida

Electric scooters are steadily becoming a popular alternative for short commutes. Besides convenience, however, they also introduce a range of cybersecurity and privacy risks, according to a study by the University of Texas at San Antonio (UTSA).

The review – which UTSA said is “the first review of the security and privacy risks posed by e-scooters and their related software services and applications” – outlines various attacks scenarios that riders might face and suggests measures to tackle the risks.

Many e-scooters rely on a combination of Bluetooth Low Energy (BLE) and the rider’s smartphone internet connection to run, as well as to send data to the service provider. This opens up a number of avenues for potential attacks. For example, bad actors could eavesdrop on the data being broadcast, which could, in turn, lead to Man-in-the-Middle (MitM) and replay attacks. As a result, in some cases hackers could remotely inject commands to take control of the scooter and harm the rider or pedestrians. In fact, this very risk was already discovered in one of Xiaomi’s scooters last year.

A scooter’s battery, engine, brakes, headlights and controller chip are among the key components that can be targeted during a physical attack. Attackers can then swap out key components or install “malicious modules” allowing them to remotely control the scooter or gather private information on the sly. By remotely manipulating the brakes and acceleration, the bad actor can injure the rider and/or other people.

Micromobility apps usually track the e-scooters’ whereabouts, which means that location spoofing is another thing to worry about. Bad actors can, for example, lure a rider to a secluded area to harm them.

E-scooter providers require a wide range of information from the riders to sign up for their service. Usually, these include some form of identification, along with billing, contact and demographic information. The providers automatically collect additional data, including GPS and smartphone-specific information. Attackers with access to such data can create a comprehensive image of riders’ habits, places they frequent, and routes they are likely to use.

Most of the risks can be mitigated by implementing cybersecurity best practices. Employees recharging the scooters could check their mechanical or electrical components to make sure nobody had tampered with the scooters. As for the looming privacy risks, one of the best steps would be to implement a privacy-by-design approach for the applications, making the parts that handle data inaccessible to unauthorized personnel. In addition, data traffic monitoring would help the service provider to react to threats in real-time.

Would you get hooked by a phishing scam? Test yourself!

As the tide of phishing attacks rises, improving your scam-spotting skills is never a bad idea

Amer Owaida

Many people are confident in their ability to recognize phishing scams a mile away. In a recent survey, however, only 5% of the respondents had a 100-percent success rate in spotting simulated attacks aimed at stealing their sensitive information. This may ultimately help explain why this type of fraud continues to pay dividends for ne’er-do-wells.

The survey and quiz of over 900 Americans, conducted by security.org, also found that 9 out of 10 respondents could match phishing with its definition fairly accurately. The vast majority also knew that such attacks often begin with an email. On the other hand, not all the respondents were well versed in other forms that phishing could take.

Here’s a quick refresher: At its simplest, phishing is an unsolicited email, text or any other form of electronic communication where attackers impersonate a trusted institution and attempt to purloin your data. The information, such as your login credentials, can then be misused or sold by the attackers for nefarious purposes, usually fraud and identity theft. According to the FBI’s latest Internet Crime Report, the number of victims of phishing attacks increased by 59% between 2015 and 2018. It’s also safe to say that many cases of online fraud go unreported.

Back to the survey, however. Almost one-half of the respondents didn’t associate phishing with malware campaigns, whereas a similar proportion were unaware of possible links between the scams and malvertising. Meanwhile, one-third didn’t think phishing could happen through social media. As ESET researchers have documented numerous times, social media are increasingly abused for phishing attacks.

There is a generational divide present as well. Whereas millennials were more likely to think that phishing campaigns can take place through social media, baby boomers were more skeptical. By contrast, when it came the question of whether an email could be used for phishing, baby boomers were particularly amenable to the idea.

Even if you’re aware of this pervasive online con, it doesn’t necessarily mean that you’re immune to taking the bait. Indeed, academics have devised a test that gauges people’s susceptibility to falling for scams based on a number of personality traits.

At any rate, there are several easy-to-follow practical steps you can take to protect yourself against phishing attacks:

·         Never click on links, download files or open attachments in messages even if they appear to be from a known, trusted source – unless you are absolutely sure that the message is authentic.

·         Always scrutinize the email address, established institutions usually use their own domain and not, say, a Gmail address.

·         Look out for shoddy spelling and grammar mistakes, as phishing emails are often ridden with them.

·         Watch out for domains that are often slightly altered to resemble the domains of legitimate service providers.

·         Be wary of a sense of urgency or threat that the messages typically seek to evoke.

For a more detailed treatment of tell-tale signs of phishing, please refer to Phish Allergy – Recognizing Phishing Messages.

The quiz is available on security.org, but if you’re up for more testing, you can always take Google’s test we wrote about recently.

Indeed, why not take ESET’s free cybersecurity awareness training?