The Coming Mac Threat (Revisited)

Foreword

The following article was written and published in 2008. The first iPhones were less than six months old and Apple's OS X operating system was just seven years old. The previous year Apple launched a version of OS X that could run on Intel systems. The following year OS X could *only* run on Intel systems. This could have made life easier for attackers, as they faced a familiar underlying system.

A lot has changed since then. According to some statistics the use of OS X (now MacOS) has risen between 2009 and 2021 from below 4% to around 16%. This is clearly a significant rise, but with around 75% of computer users still staring at Windows, the value to an attacker of MacOS exploits is still relatively low.

Attackers have targets and the chances of a valuable one using a Mac is now five times as likely. We've seen news reports of exploits targeted Apple-based devices. NSO's Pegasus spyware is now widely recognised as being a threat that targeted civilians, including journalists.

12 Security Tips (revisited for 2021)

How much has computer security changed in the last six years?

In 2015, six years ago to the day, I published a 12-point security tips list. The goal was to advise on the most effective ways to improve your computer security, starting from the most important and working down.

How well does that list stand up today?

Do the original tips still stand? Are there any missing?

Backup Windows 10 to an encrypted drive more easily

Back up your data to an encrypted external disk for free - money-free and hassle-free.

Summary: use auto-unlock so you don't need to enter your drive's encryption password every time you use it.

Backing up your data has always been important but, with the rise of ransomware, never more so than now...

How was Hacking Team hacked?

The attacker who stole Hacking Team's data gained access to an employee's computer while the victim was still logged in.

The attacker either had direct physical access to Christian Pozzi's PC or they used malware to achieve a similar level of access. Whichever way it was, we can tell that Christian was logged in at the time simply by looking at a folder name among the files that were leaked onto the internet.

12 computer security tips

The bad guys can try to break in using computers only or they can try to trick you into providing them with access. Or they can use a mixture of tactics. Let's consider two main types of attack:

* Technical – breaking in via computers only
* Human – tricking people into aiding the attack

For the technical attacks you might consider the following, in order of priority/effectiveness:

Password recovery with Elcomsoft System Recovery

(Part three of Three ways to recover from a forgotten Windows password)

You've forgotten your Windows password. What now?

Password reset accessibility hack

(Part two of Three ways to recover from a forgotten Windows password)

You've forgotten your Windows password. What now?

Password Reset Disk

(Part one of Three ways to recover from a forgotten Windows password)

You've forgotten your Windows password. What now?

Three ways to recover from a forgotten Windows password

You've forgotten your Windows password. What now?

I’ll show you three different ways to get back into your system:

1. The ‘right’ way
2. A free but dirty hack
3. An elegant but $50 hack

Vulnerable security software

Last week the Superfish debacle became news and PC manufacturer Lenovo was slammed for pre-installing adware on new laptops.

Since then I've had people ask me about how dangerous this stuff actually is and whether or not security software that works in similar ways poses similar threats.

Does your smartphone belong to you?

That expensive smartphone (iPhone, Android, whatever) that you spend your life staring at - is it yours? I mean, really under your control?

Do you have complete mastery over the content that it accesses, the files it downloads and the behaviour that it tracks?

If you buy a digital book will that book always belong to you, or could it disappear one day if the publisher decides to withdraw it?

If you aren't interested in a music band will its latest album appear on your device automatically?

Who has access to information about your personal fitness, such as how long it takes you to complete a run, and how often you exercise?

Apple has, with its iPhone and, to a lesser extent, OS X-based personal computers taken away some of the control that people assume they have over their electronic devices.

Most people don't seem to care, possibly because they don't realise that their £600+ device is actually controlled by Apple rather than them. So when something happens that highlights this fact the result is shock and outrage.

This last week Apple launched a new iPhone and simultaneously made freely available rock band U2's new album Songs of Innocence to 500 million iTunes customers.

This caused many vocal users to express their enormous, four-letter-word-based displeasure via Twitter.

The problem seemed not that Apple was giving away some music but that it was appearing on people's devices without their explicit consent.

That, and the fact many people tie their identities up with music so closely that getting it 'wrong' is more than annoying - it can be insulting.

If Apple had wanted to offer a music album for free it could have sent out vouchers to iTunes users' email accounts or pushed some sort of offer through iTunes itself. Instead it rather arrogantly uploaded the music to people's devices while providing no clear way for them to remove the content.

Days later the company issued a removal tool.

Apple is not the only company to control personal electronics, though. Android devices are ultimately controlled by Google, which is why the company is able to offer remote locking and wiping services, and all your files end up in the cloud unless you are very careful.

Google hasn't (yet) pushed content in the same way as Apple, though, and just two weeks ago it made available a Shaun the Sheep cartoon for free via its Play store. I don't remember a Twitter-storm of angst when that happened, probably because no files were automatically uploaded.

Amazon's Kindle is also controlled remotely and Amazon has, in distinct contrast to Apple's latest stunt, actually removed content from users' devices in the past. In 2009 it deleted copies of 1984 and Animal Farm due to copyright issues. This was an unpopular move because, again, it highlighted the fact that these devices are a means for content consumption and are managed remotely by those who largely sell the content.

We live next to these devices 24/7 and they are so important to us that online surveys abound that ask questions like "Would you rather lose your smartphone or... get a bad haircut/go without sex/something else?" The idea that they are not really ours and under our complete control is more than uncomfortable - it's unbelievable. Which is why so many people get upset when it's pointed out to them in no uncertain terms.

Mobile phone kill switches

Microsoft and Google have just announced so-called kill switches for Windows Phone and Android devices.

Apparently this is a response to a reduction of iPhone thefts reported since Apple introduced Activation Lock into iOS 7.

Kill switches are great in principle but hard to implement properly.

Don't assume that a kill switch will 'brick' a phone.

A kill switch is a way to render a lost or stolen phone useless, but currently they don't really do that. Or not fully, at least.

Users can lock or wipe Android devices remotely using third-party apps and, more recently, the Android Device Manager. Windows Phone users will soon see similar abilities included in the Find My Phone feature.

Wiping resets the device and that effectively means the thief (or whoever finds it) gets to keep a fresh and functional gadget. A locked smartphone can be reset too. The data may be wiped but someone else gets the benefit of your expensive hardware.

It's been possible to lock and wipe mobile devices from the major vendors for a while now. The real news is that these security features will soon be enabled by default.

The official statement from Attorney General Schneiderman includes, right at the end, the following:

"Because kill switches are only available on an opt-in basis, not enough consumers are signing-up. This underscores the urgency... to make kill switches a standard opt-out function on all phones."

So we've had kill switches for a while and now they will be opt-out. So far so good.

The kill switches used or planned by Apple, Google and Microsoft are based on software. As we know, there are ways to resurrect a phone locked down by software.

A more effective option would be to build new phones with hardware kill switches. Imagine a fuse that can be blown remotely. The device would then be properly 'killed' and would require expensive repairs to restore the device.

Hardware kill switches bring their own problems.

1. How do you test that they work without destroying your new phone?
2. If you can't test the kill switch, how confident are you that it will work when you need it?
3. You might 'brick' your lost phone and then find it down the back of the sofa.

If introducing software security features reduces thefts of expensive devices then it's worth doing, but users should be aware of the limitations inherent in this approach.

One final thought: if an unauthorised individual or organisation was to gain access to your account they would be able to kill your phone, tablet or other mobile device. If the kill switch was a software version then you'd experience significant inconvenience. If it was of a hardware type you'd face additional cost.

Why don't people encrypt email?

Most PGP/GnuPG reviews/howtos I've seen start with long description of public key cryptography and instructions on key generation.

And that's the problem.

(I've been using PGP/GPG for 20 years and I still use a cheat sheet).

Are Chromebooks insecure travel companions?

Do not connect a Chromebook to a public wireless network if you don't want to risk leaking personal information.

This advice is not some half-baked journalistic opinion but comes direct from the UK government’s National Technical Authority for Information Assurance (CESG).

The CESG advises that even for data with the lowest security classification [PDF], labelled 'OFFICIAL', Chromebooks are unsuitable for a number of reasons, one being that the Virtual Private Network (VPN) included is not up to scratch and there are no viable alternatives.

Yesterday the organisation published its End User Devices Security Guidance: Chrome OS, which states:

"The VPN has not been independently assured to Foundation Grade, and does not currently support some of the mandatory requirements expected from assured VPNs. The VPN can be disabled by the user and some Google traffic is sent prior to the VPN being established resulting in potential for data leakage onto untrusted networks. Without assurance in the VPN there is a risk that data transiting from the device could be compromised"

There is a similar warning in the Android guide that the in-built VPN for Android 4.4 has not been assured, although it does not appear to leak data automatically and there are alternatives available.

If you don't use a VPN when using public WiFi then you are at no greater risk when using a Chromebook than any other device, but if you are security conscious and want to stay safe when moving around at home and abroad it's better to stick with an Android tablet than move over to a Chromebook.

Three Android Security Essentials

I recommend the following three tools for improving your security when using Android phones.

These will allow you to:

1. Locate or disable a lost or stolen phone
2. Prevent surveillance of your WiFi and mobile data use
3. Further improve the security of your internet accounts

Additionally protection from malware is provided by the second tool but, for Android, I don't believe that such threats are currently significant for users who avoid unofficial application stores.

Two tools are free. I've included one that is not because I believe that the free alternatives are not sufficient.

Google Android Device Manager
Why: Ring, lock or erase your phone remotely
Cost: Free
Where: Already installed or Google Play Store

Install the application if necessary and visit the management console using another computer (phone, tablet or PC), logging in with a Google account that is present on your phone.

If you lose your phone nearby you can locate it using its ringer. If you lose it further afield you can locate it using GPS. If it's really lost or stolen you can wipe it.

More information, including a video on what the wiping process looks like.

F-Secure Freedome
Why: Use public WiFi networks safely
Cost: £20.99/year (or £2.99/month)
Where: Google Play Store

Prevent others from monitoring your internet use, passwords and other sensitive data by clicking the Protection button.

When it says 'On' your connection to the internet is encrypted, even if the websites you use do not use encryption.

Additionally this product claims to protect against web-based threats including harmful applications, websites and sites that track your online activity.

If you are considering a free VPN bear in mind that you don't necessarily know who is running it and what information they are taking from you to fund it.

Google Authenticator
Why: Increased security for your internet accounts
Cost: Free
Where: Google Play Store

Not only available for Android, this security tool makes your internet accounts much harder to crack.

Compatible services include Google Apps and Mail; Dropbox; LastPass; and WordPress. That is just a short list of those using Authenticator.

How to handle lost Android devices

If your Android device has been lost or stolen, you can reduce your losses.

It's always a shame to lose expensive items but quite possibly you value your data, such as photos and email, more than the box of tricks that lets you access it.

Let's work on the assumption that you have allowed Google to backup your photos and so on, and that your email and other files are also 'in the cloud'.

Imagine, then, that you've lost your phone or tablet. You have a few choices. You can:

1. Do nothing
2. Locate the device
3. Lock the device
4. Wipe the device

Options two, three and four usually involve installing some third-party security software.

Arguably this is one of the best reasons to install an anti-malware product into an Android device because there's little chance of accidentally becoming infected if you stick to the Google Play store. According to mobile security firm Lookout those in the US and Western Europe were very unlikely to encounter malware on their phones and tablets.

That said, last year Google enabled the Android Device Manager (ADM), which is included in recent versions of Android. This does the job nicely without the need for third-party software.

Visit the ADM webpage and log in using one of the accounts associated with one of your devices. You will then see a list of all compatible Android devices that you own.

If you have simply lost your phone then the location feature could help you track it down. You may wish to use the lock feature before you start looking, just to be on the safe side.

Locking the device also allows you to pop up a message for anyone who finds your device, so you could provide details for its return (with or without a reward).

Ultimately, though, if you think the device is gone for good you might as well wipe it. If someone finds it they get a fresh second-hand device but your data, login details for your internet accounts and so on are no longer available.

The video below shows a very quick (around two minutes) summary of what you can expect to see (and what the thief sees) when you first lock the device, providing a message to help them return it.

We'll also pretend that we've given up on the idea of ever seeing our tablet again and wipe it completely.

The tablet above is a Nexus 7 that was encrypted for extra security. None of the above techniques will work if the device is offline, which includes being turned off. That means encrypted devices, once rebooted, cannot be wiped as they will never get to the point of connecting to the internet - unless the thief knows and uses your encryption password.

The upshot of this is, if you encrypt your devices and then lose them you should issue the wipe command as soon as possible. If not, when they inevitably run out of power, you'll have no way to contact them. Of course, with encryption in place you may not care.

Exploring web threats

How to examine malicious websites and their effects - for professional beginners.

If you want to capture a live sample of a phishing website, or a site that is infected with malware, the techniques covered will help.

These tips are particularly useful considering how malicious websites can come and go very quickly.

I wrote this presentation for a customer who wanted a way to analyse some of the main threats to its users and to help when problems occurred. The solutions and threats included:

1. Phishing websites designed to steal account details.
2. Sites hosting exploits and malware designed for stealing account details.
3. Malware infection detection.
4. Malware removal tips.

You can download a free PDF of the presentation I gave.

If you just want an introduction to HTTPReplay and Fiddler2 then this might be helpful also.

USB condom pumped up in press

Some IT news websites have posted excited articles about a new 'USB condom' that protects devices from hostile charging stations.

Unless I'm missing something, I think this excitement is a little unwarranted.

The threat

You plug your phone into an untrusted USB charger. This is secretly connected to a computer that mounts the phone's storage and accesses its data. This is known as 'juice-jacking'.

The solution

If you must charge your devices using an untrusted charging station you may improve your security by turning them off completely. You should receive a faster charge that way, too.

Alternatively use a USB charging cable, which is like a regular cable but the data pins are not connected. You can make one of these yourself very cheaply. It's not hard but, if you don't want to DIY, ready-made options are inexpensive - frequently less than £5.

The USB condom

The USB condom works by "cutting off the data pins in the USB cable and allowing only the power pins to connect through." So, very much the same as a USB charging cable then.

Pricing for this connector is not yet available* but, if it is very much lower than £5, it'll be a worthy addition to any security-conscious traveller's cable bag.

* UPDATE (18/09/2013): Pricing for these devices is now available. The USB Micro-B and USB Type A models are $9.99 each. In my opinion that is poor value for money.

Using OpenOffice files in Word

Some libraries only support more
traditional formats

Last weekend I was in my local library and overheard a young boy discuss a problem with the two librarians (it's a small library).

His ICT homework was stored on a flash drive and he could not open the files to print them.

The information workers were nonplussed and assumed that he could not download the files from his drive. Against by better judgement I became involved.

The problem was that his files were in OpenOffice format and the library computers were running a fairly old version of Word on Windows XP. Whatever version it was, it could not read the OpenOffice files in any meaningful way. We tried all the text encoding options but it just wasn't happening.

I suggested that we search online for a website that could convert OpenOffice documents to Word format. The first link led us to a specific page on online-convert.com that allowed us to upload the two files and, within seconds, download Word-compatible versions.

These appeared to be perfect and the young man's homework assignment was complete, assuming he managed to print them.

Probably the ideal solution, when using OpenOffice, is to save files in native (OpenOffice) format and export copies to a widely-compatible format. I've always found Rich Text Format (RTF) to work well*.

OpenOffice also supports the format used by Word, so one could save straight to Word format if necessary. Hindsight is a wonderful thing.

I've read that uploading files to Google Drive is also a useful way to convert them. Nothing is quite as private or secure as using your own computer for the conversion, though.

---

* I was first taught about the wonders of RTF when studying at the London College of Printing and Distributive Trades (LCP for short, and now called the London College of Communication).

This was in the days before digital printing was anywhere close to being a reality. In my first proper job we used to send large sheets of film off to the printers by courier. When things started to turn digital we switched to sending out SyQuest cartridges instead.

We were pretty advanced compared to some publishing companies in London at the time.

The mystery of Google's app for wiping and locating phones

Late last week the media predicted the imminent launch of a new Google application for Android phones that would allow users to locate or wipe their devices.

The Register wrote, "Google has announced that it will begin offering a free device location and security service for Android phones and tablets for the first time later this month, addressing a longstanding (sic) omission in Mountain View's mobile OS."

Such security features are often included with anti-malware applications, while there are also dedicated apps that provide only the location and memory-wiping abilities.

The news that Google was going to launch its new Android Device Manager security service and application made me a little confused. I thought it already had put out something similar ages ago. In fact I remember seeing an app called Google Apps Device Policy on pretty much every device that I've used.

Here is Google's description of Google Apps Device Policy:

***THIS APP IS FOR GOOGLE APPS FOR BUSINESS, EDUCATION, AND GOVERNMENT USERS ONLY***

Google Apps Device Policy makes your Android device more secure

* Ring or locate a lost device via My Devices (https://www.google.com/apps/mydevices)

* Remotely lock device or change pin

* Administrators can enforce security policies and remotely wipe devices

The app is clearly only available to use for those who pay for Google Apps. Indeed, if you visit the URL above you'll see a message verifying that fact.

My confusion was compounded, however, when I came to verify the name of the app before writing this article. My current phone and tablet, a Nexus 4 and Nexus 7, are running the latest version of Android (4.3) and now no longer show Google Apps Device Policy as being available.

As the first screenshots above show, though, the program was certainly installed at some point. In fact it has been installed not only on the devices I use day to day but also on the first Android phone I ever bought and all devices bought since.

It's great news that ordinary users will have access to these features. It's just a little surprising that a similar, installed product seems to have become invisible or been removed.