Articles about Security

Microsoft has long looked lovingly at identity, and providing the "one" that binds consumers and businesses to Windows. Users benefit by being freed from managing multiple identities and passwords across the web and, presumably, by improved privacy and security as a result. Microsoft gains by controlling a master identity system that keeps some of its core technologies relevant.

But Microsoft couldn't bring a single-identity system to market during the last decade. Privacy groups filed complaints about Passport, leading to a Federal Trade Commission investigation and later a settlement. Soon after, Microsoft settled its US antitrust case, agreeing to five years government oversight that instead went on for nearly 10. But Federal and state watchdogs left in September, and as I explained then Microsoft is freer to integrate stuff into Windows. Today, Dustin Ingalls, Windows Security & Identity, explains exactly how Windows 8 will tackle the identity problem.

Continue reading →

Carrier IQ is once again making headlines, this time over reports that it is giving information to law enforcement. Complicating matters more, the FBI denied a Freedom of Information Act (FOIA) request last week asking about its own use of Carrier IQ technology, saying the release of such documents "could reasonably be expected to interfere with law enforcement proceedings".

The FBI's admission in the letter that documents do exist raises concerns that Carrier IQ is using its technologies more than just for customer experience purposes, but actual spying as it is being accused of by many pundits. The company is moving quickly to quell this latest round of criticism.

Continue reading →

Developerinabox has released a major update to its powerful open-source surveillance software. iSpy 3.5.0 allows Windows users to use a collection of webcams and microphones as part of a complete security system for free, although certain features, including remote access and email alerts, require a monthly subscription.

Version 3.5 promises vastly improved resource management, and adds two major new features: the ability to detect and recover from crashes and hangs, plus a built-in media browser.

Continue reading →

Android users have a multitude of options in order to detect whether Carrier IQ exists on their smartphones, with at least a dozen applications available through the Android Market. While most of the apps will not stop Carrier IQ from running, they will at least give those concerned with the company's actions some solace in knowing for sure whether they're being tracked or not.

Carrier IQ's discovery -- that stealthily monitors cellular users' smartphone activity -- set off a firestorm of controversy over the past several weeks. Some see it as a serious threat to users' security and privacy, while others have likened the reaction to mass hysteria generated by the media.

Continue reading →

Microsoft has rolled out the latest build of the Windows Defender Offline beta, a version of Windows' anti-spyware feature that is meant to be executed from a DVD or USB flash drive before Windows even starts up.

Windows Defender is included with Windows and has agents that can be run periodically, or at all times on a running system. Because it runs inside Windows, though, it is limited in what it can do.

Continue reading →

If you have any private photos on Facebook that you really don't want out there, consider this story your fair warning to delete them. A flaw in the social networking site's reporting mechanism allows users to peer into content that is otherwise marked "private". Now would be a good time to remove that pic of drunken you mooning the boss.

The flaw was first widely reported on the forums of bodybuilding.com, a popular fitness site. The post -- since removed -- details the exploit. Proceed through the menus after reporting an image as inappropriate. When the dialog asks if you want to report any other images in the album, click "yes". All images, whether public or private, will be displayed.

Continue reading →

We have some division here at BetaNews regarding Carrier IQ and reporting about its tracking software. On one side there's the "me-too" defense -- that software stealthy hidden on smartphones sending information back to Carrier IQ or cellular carriers is no worse than what other companies do. That it's irresponsible to report keylogging behavior based on researcher Trevor Eckhart's blog post and YouTube video. That early reporting was "sloppy" and Eckhart is suddenly "quiet". Dog poop.

Over the last couple days, Carrier IQ finally responded to the maelstrom of controversy. But the response falls short. Carrier IQ fails to address the most troubling aspect about Eckhart's demonstration: Capturing data from keystrokes, nor does it answer why so much information is collected. Carrier IQ's defense is something like: "We don't look at the naked person. Not us". It's the "if a tree falls in the forest" defense. "We didn't listen, so it didn't happen". If there's anything "sloppy" about the news reporting, it's that not enough journalists dig deep enough. There's nothing unfair here.

Continue reading →

If you’re worried about your phone or tablet being lost or stolen then it’s generally very easy to get some help. Just check a box in your iPad settings, or install a suitable app, and if your device goes astray you may be able to track its location, send messages to the thief, even remotely lock or wipe the device to prevent anyone accessing your files.

If you’d like the same protection for your Windows laptop, though -- or, even more conveniently, want to use the same service to cover all your devices -- then the choice is considerably more limited. Although, fortunately, there is one strong contender in the Prey Project.

Continue reading →

The furor over Carrier IQ tracking software only intensified on Thursday, as different affected parties attempted to limit public relations or potential legal damage. Apple and Verizon both essentially disavowed Carrier IQ, while Sprint acknowledged using the software/service but narrowed the scope. Meanwhile, the Carrier IQ website couldn't handle sudden traffic surges. BetaNews used a Google cached version to obtain the official statement, but later reached the site.

Android developer Trevor Eckhart instigated the Carrier IQ scandal in a blog post and YouTube video based on his investigation of a persistent process running on HTC Android phones. He uncovered Carrier IQ, which he calls a rootkit because of its stealth behavior and the amount of information/services tapped. "The application is hidden in nearly every part of our phones, including the kernel", he writes. "Carrier IQ also subverts standard operating system functionality".

Continue reading →

Anyone with children will know that it can be difficult to police use of the Internet. The fact that you have young children means that you are naturally concerned about web content, and many parents would love to be able to use the Internet with their offspring to ensure that they don’t stray into unwanted territory.

But in reality, this is often impractical as there are few people who have the time spare to be able to monitor their children, however much they may want to do so. AVG Family Safety is a software alternative to a parent’s watchful eye, making it possible to not only monitor but also control what your children use the Internet for.

Continue reading →

Okay, the stupidity lies with cellular carriers who let the tracking software onto their phones. Their actions will irreparably tarnish the industry's image and quite likely lead to unwanted government intervention. I'm assuming, of course, that Carrier IQ really is as bad as Android developer Trevor Eckhart claims. My God, what if it's worse?

Carrier IQ is tracking software that behaves every bit like a keylogger -- installed at a low-level like a rootkit would be. It logs all activities. That's right. Everything, even when the phone is disconnected from the network, or when using WiFi, and it continues its privacy-violating ways even after a cellular subscriber's contract has expired. Simply put: It's an abomination. It's a violation of privacy in the worst way, because cell phones are the most personal tech devices and used to maintain the most intimate relationships.

Continue reading →

Microsoft has released a public beta version of its Windows Security Essentials package, giving users a sneak glimpse of what to expect from future releases. There are not a huge number of changes to speak of, but the release is an important advancement for a home-user friendly security suite that has gained a large following since it debuted. Windows Security Essentials 4 beta is available right now to anyone with a Windows Live ID.

There are some minor interface tweaks to be seen in the application, but it is the improvements to performance and the detection process that are most interesting. One of the concerns with running any security software is the potential for it to impact on system performance -- and this is one reason why many people simply do not bother installing security software. Performance tweaks help to reduce the strain on your system while it is protected.

Continue reading →

The United Nations finds itself resecuring its network Wednesday following a hack that resulted in the login details of the employees of several divisions being posted to the Internet. Calling itself TeaMp0isoN, the group calls the UN "a Senate for global corruption" and "sits to facilitate the introduction of a New World Order and a One World Government".

TeaMp0isoN hacked accounts belonging to employees of United Nations Development Programme (UNDP), Organisation for Economic Co-operation and Development (OECD), UNICEF, World Health Organization (WHO) among others. Some of the fault for the hack may lie in the users themselves: TeaMp0isoN notes that several of the user IDs contained no password at all.

Continue reading →

Earlier this month, Android developer Trevor Eckhart looked into an always-on process in his HTC Android phones called Carrier IQ, and discovered the application was actually capturing all user actions (ostensibly for the purposes of "mobile service intelligence") without providing users the ability to opt out or shut off the process.

In fact, Eckhart suggested the only option to escape the keylogging behavior of the application was for users to root their phone and install new firmware without it. For this reason, Eckhart classified Carrier IQ as a rootkit.

Continue reading →

Columbia University's Intrusion Detection Systems Lab has found a significant core vulnerability in certain networked HP printers that lets a remote system infiltrate print jobs, remotely inject malware into the printer's firmware that takes control of the machine.

The lab, headed by Professor Salvatore J. Stolfo, has been doing research on the vulnerabilities of embedded systems for the last year, identifying more than 540,000 publicly accessible embedded devices configured with factory default root passwords: this includes routers, VoIP phones, webcams, digital energy systems, and IPTV/Cable boxes.

Continue reading →