This week’s Knowledge Update talks about Janus vulnerability allowing android app takeover, USB encryption and security fall well short and researchers find Trove of 1.4 billion breached credentials
Janus Vulnerability allows android app takeover
An Android vulnerability has been uncovered which allows attackers to modify apps in an undetected way without compromising the apps signatures.
According to Guard Square, the flaw (CVE-2017-13156) allows a file to be a valid APK and DEX file at the same time. Depending on the targeted application, a hacker can get hold of sensitive data and information that may be stored on the device or take over the device completely.
The Janus vulnerability has compromised Android 5.0 and newer devices. Google has released a patch to its OEM partners so once a new update is available it is imperative that it is implemented. Updates should be installed across all devices and where possible software should be set to update automatically.
Your organisation should consider the devices that employees are allowed to use on the company network, more information on securing your business through device control can be found here.
USB encryption and security falls well short
A recent survey from Apricorn of more than 400 IT professionals from a large variety of industries revealed that most employees use USB drives yet companies are leaving themselves vulnerable to data breaches as their use is ineffectively monitored.
Within the report, Apricorn have said “With the ever-increasing amount of data breaches and compromises, companies need to carefully monitor what data is being created in their organisations and what is leaving.” Nearly 80% of the responses have said that the protection of confidential information stored on USB drives is a high priority.
Protecting data is a legal duty. Cyber Essentials provides a framework, backed by the UK government, for businesses to improve their information security. More information can be found here.
Data breaches can affect any size of the company, large or small, reporting data breaches will be a key part of the coming General Data Protection Regulation. Organisations of all sizes will have to comply with the coming of GDPR or be at risk of punitive fines. A support pack and compliance guide can be found here.
Researchers find Trove of 1.4 billion breached credentials
Security researchers claim that they have discovered a database that contains 1.4 billion breached credentials, one of the largest data breaches discovered on the dark web.
According to Julio Casal, co-founder of 4IQ (a dark web analysis firm), the list is said to be nearly two times as big as the previous largest breach, an Exploit.in database that exposed 797 million records.
It is an aggregated interactive database that allows for fast searches and new breach imports. Hackers will be able to automate account hijacking or account takeover due to the fact that people reuse passwords across their emails, social media, online shopping, banking and even work accounts. The most popular password that has been used is “123456” which has been used over 9.2 million times, followed closely by the password “123456789” which has been used over 3.2 million times.
Password control should be implemented on all devices. Password policies should be developed that contain rules for password length and password complexity. The same password should be never be used for different accounts and password should not be shared. Where possible Two Factor Authentication should be implemented. Staff should also be made aware of the importance of having strong and separate passwords, more information on how to keep your business secure can be found here.
For more information contact [email protected] or visit www.londondsc.co.uk.
Hello There. I found your blog using msn. This is a really well written article.
I will make sure to bookmark it and come back to read more
of your useful information. Thanks for the post. I will definitely comeback.
Keep on writing, great job!