Wednesday, 12 October 2011

Sony to send password reset email

Sony have detected someone trying to gain access to their various networks again, by using ID and password pairs that Sony conclude have been extracted from someone else's network. This may be a valid conclusion as it was only a small percentage of users that were affected (less than 0.1%, which is still 93,000). Sony have been upfront and quick to react, disabling the affected accounts and putting out a notice.

However, their next step, according to the notice given by their Chief Information Security Officer (CISO), is to send all the users who have been affected an email asking them to change their password.

Cue phishing scam!

Surely some bright spark will now construct a phishing email to send out to everyone saying that theirs was one of the 93,000 IDs compromised and could they now change their password. A simple copy of the site would then enable someone to lift thousands of valid credentials from accounts that weren't compromised. The problem is that Sony's users are now expecting an email to arrive to tell them to change their password. The work to trick someone to follow a link has already been done by Sony and the media.

How about not sending an email? Instead, publicise the attack and that some accounts have been disabled (Sony has done this). Next, let the users come to the Sony sites and try to log in. Then you can inform them that their account has been disabled and what the password reset procedure is.

Tuesday, 11 October 2011

Password Protect Your Mobile

I know that many security 'professionals' will scaremonger and preach doom and gloom at every turn in order to drive up sales. However, they're not always wrong. I read the article 'Mobile device users fail to take basic steps to protect themselves, survey finds' and wanted to relate an event that happened this weekend. Many people are saying that mobile device security threats are hype and that nobody is actually exploiting them. That's possibly true to a certain extent at the moment, but for how long? Another article claims that identity theft is now more profitable than car theft! A mobile phone is a very good start for this purpose.

An interesting figure that comes from the article above is that 160,000 mobile phones are lost or stolen every day. I assume that this is just in America, as in Britain the figure is around 20,000 a day. Whether or not these figures are accurate is immaterial, the fact remains that a lot of phones go missing. What do you have access to from your mobile?

The recent incident that I mentioned above happened on Sunday. Someone left their iPhone at a sports training ground I was at. On inspection of the phone, there was no authentication set on it at all. I was able to see photographs, names, addresses and telephone numbers of family and friends. In addition to this, they had a Facebook App, which was still signed in. It would have been very easy to update their status with a malicious link for all their friends to visit. Worse than this, however, was the fact that they had access to their corporate email and address book from the phone - a FTSE 100 company. Again, this was still signed in with no additional authentication required. What corporate information could I have gained access to?

As it was, a phone call to the telephone number entered as 'Home' enabled the phone to be returned without stripping data off it or sending phishing messages. However, what if someone else had picked it up? The survey in the article stated that, of those interviewed, over 65% used their mobile phone to access corporate email and networks. "Do you send or receive sensitive information via email?" should have been the next question.

Businesses and employees should think carefully about the data held on their devices and the level of access they have to the corporate network. At the very least people should always have some form of authentication set on their phone, e.g. a PIN, password or stronger authentication. The majority of users leave applications, such as email and social media accounts, perpetually logged in and many users leave their devices unlocked. Even when they are forced to lock them due to policies, they don't always really secure the device. I have seen many users with corporate phones that require passwords use simple passwords (such as 'qwerty') so that they are easy to type. They site difficulties in typing complex passwords as being the major reason for choosing simple passwords, which is in line with the findings of the survey.

The bottom line is that these devices are part of the corporate network, whether the IT department is aware of them or not. They need protection. Even as an individual, protect your identity and your contacts by employing automatic locking of your mobile with passwords or long PIN numbers and don't leave apps permanently logged in. (I find it surprising/worrying that I have to give this warning/advise!)

Welcome to the RLR UK Blog

This blog is about network and information security issues primarily, but it does stray into other IT related fields, such as web development and anything else that we find interesting.

Tag Cloud

Twitter Updates

    follow me on Twitter

    Purewire Trust