2022-02-25

Spring-cleaning

Image from Pixabay


Collecting the articles for the section And in the big bad world… continues all week, day and night so to speak. If I come across an article that might be of interest, I put the link in the Pocket app. And on Friday morning, when I write the blog, I pull those articles out again, read them and decide if they can come along.

Occasionally I also put an article for private use in Pocket. And admittedly, sometimes I keep some pretty crazy articles, thinking: this is something you never think about, but maybe I can learn something from it. And that's how the article entitled How to clean your toaster the right way from lifehacker.com ended up there. That article has been serving as a bookmark in Pocket for a long time: when I arrive down there, I know I'm done with the articles for the blog.

This week I finally read that article. And actually learned nothing new. But as with so many things in daily life, my inner voice also asked: hey, isn't that a topic for the blog? Shouldn't you write something about cleaning your digital life and keeping it tidy? It certainly benefits from maintenance. Do you remember your whereabouts on the internet? You are vulnerable in all those places and that is why it is important to maintain control over them.

Start with a simple exercise: google yourself. That's fun and educational to do, and it's also a bit like bringing out the box with old photos (yes you young people, in the old days one only had photos on paper and you put them in an album or in a box). Doing so, I came across a publication from 2006 that I contributed to, I found a namesake in the south of France (who undoubtedly mispronounces his own first and last name) and a bunch of photos. So far nothing shocking. But maybe you come across something that you want to take care of.

An important question with regard to your digital life is: who can access what, what are 'they' allowed to know about you? I've talked about permissions for apps on mobile devices before here. In Android, you get a good insight into which permissions there are and to which apps you have assigned them. Do you regret anything? Then tap on that app and simply strip it of its permissions. In addition, Android nowadays has a nice mechanism: apps that have not been used for a long time automatically lose their permissions. On Apple devices, go to Settings/Privacy to see which permissions have been granted to which apps. Here too you can easily turn them on or off.

And then, of course, there are the infamous cookies. I know, we tend to click 'accept all' to move forward quickly. Sometimes you are lucky – from a privacy point of view – and there is also a button 'decline all'. But most of the time there is only a 'manage settings' button. When you arrive at that page, all options are disabled by default (or they should be). You then only have to click on 'save these settings', so you do not have to work the list.

In the first tip, I used 'google' as a verb – I didn't mean you have to use the search engine Google per se. If you want to better protect your privacy, you can use search engines that don't track you, for example startpage.com or duckduckgo.com. The latter also has the DuckDuckGo Privacy Browser (Android and iOS).

Then a tip that I should follow myself: terminate accounts that you have not used for a long time. Because through all those accounts you are vulnerable – if someone hacks into the associated site, your data may be out there. It is almost impossible to remember all the sites you have an account for, because at some online stores you ordered something five years ago and created an account for that. If you have had your password manager help you with this, you can find it there. So go through the accounts in your password manager and see which accounts can be deleted. If you can’t quit your account on a site, you can always request that company to delete all your data by invoking the GDPR (sorry, non-EU readers…).

Finally, take a critical look at your friends on social media. Do you really know them all? If not, get rid of them. LinkedIn in particular is sometimes used for social engineering: someone becomes friends with you and then tries to get information from you in a devious way. I don't use LinkedIn to get as many contacts as possible, but only accept new contacts who work with us or who I've met before.

If you still have time after this, see if your toaster could also use a cleaning.

Next week there will be no Security (b)log.

This blog post has been translated from Dutch to English by Google and edited by the author.


And in the big bad world…

This section contains a selection of news articles I came across in the past week. Because the original version of this blog post is aimed at readers in the Netherlands, it contains some links to articles in Dutch. Where no language is indicated, the article is in English.

 


2022-02-18

War

 

Image from Pixabay

War will never be the same “thanks to” technological developments. This statement fits every era of world history. The catapult, the cannon, the poison gas, the tank, the bomber, the atomic bomb, the drone – all technology that has made and will continue to make its own pernicious contribution to warfare.

But of course I'm not going to talk about machine guns here, but about war ICT. It seems like a clean weapon: no blood, no deaths, no destroyed cities. Everything is purely digital, from one computer to another. Unfortunately, that is a much too optimistic picture. As if you let two computers play a game of chess and agree that the loser also immediately lost the war and that the owner of the winning computer can take the land of the loser, without encountering physical resistance or an angry population.

No, that's not how it works. Look, until the recent past, whoever controlled the skies was supreme. Today 'the cyber', as the military unfortunately like to call it, is the playing field on which you can suffer the greatest losses. This has everything to do with the fact that we have become so dependent on our computer networks. For generals in countries with well-developed offensive ICT capabilities, it's like a candy store: they can choose from opening floodgates, crippling communications, spreading disinformation and much more.

You can use ICT to weaken the enemy before switching to more conventional warfare. In eastern Europe, the lights went out under suspicious circumstances a few years ago. And now there are reports again that Russian state hackers have massively penetrated Ukraine's military networks, power supply networks and other critical systems. This could serve all kinds of different goals. Hacking an army is a clear, direct attack on a country's defensive capabilities. But a blackout, caused by hacking a power company, can also support a military action. The Washington Post recently ran an article on cyberwarfare, and that newspaper's slogan is: democracy dies in darkness. Although this slogan is undoubtedly intended to be a bit more philosophical, the literal meaning also fits in with the current era.

A good example of spreading misinformation is the text message that the ATMs in Ukraine would not work. The Ukrainian cyber police subsequently denied this, even though the machines were reportedly out of order at the time. You cannot get further information about this (non) event on the police website at this time, because that site itself is not available due to an attack… Anyway, if people can't access their money, they get nervous, so such a message can easily lead to social disruption.

Meanwhile, the Dutch government has offered assistance to Ukraine in the fight against cyber attacks. President Zelenksy certainly didn't jump for joy when Prime Minister Rutte of the Netherlands announced this offer at their joint press conference, but I think it is a creative, modern way to help a country. I suspect Zelensky doesn't quite understand the scope of this help. When executed properly, this can mean the difference between a sitting duck country and a country that can defend itself. The digital war may only serve to support the physical one, but it can make a difference.

In that light, it’s bad news that a Dutch server is involved in a cyber attack on Ukrainian banks and ministries. Rutte's helping hand and the company where that server is located have of course nothing to do with each other, but for the world the label 'Netherlands' is attached to both. “You offer to protect us and at the same time you attack us?” Meanwhile, the server in question has since been taken down at the request of the Dutch police.

As mentioned, the image of a clean cyber war is wrong. If sluice gates are opened or water purification is affected, this will indeed lead to casualties. And when reconnaissance satellites are knocked out to give the attacker a chance to roll his tanks into a country undetected, blood will spill as soon as the first shot is fired. No, like all forms of war, cyber war is ultimately dirty, barbaric and unworthy of man.

This blog post has been translated from Dutch to English by Google and edited by the author.

 

And in the big bad world…

This section contains a selection of news articles I came across in the past week. Because the original version of this blog post is aimed at readers in the Netherlands, it contains some links to articles in Dutch. Where no language is indicated, the article is in English.

… the Russians probably hacked all kinds of systems in Ukraine.
https://www.washingtonpost.com/national-security/2022/02/15/russia-ukraine-cyber-attacks/

… a server on Dutch soil was involved. [IN DUTCH]
https://www.bnr.nl/nieuws/technologie/10467810/nederlandse-server-beakte-bij-cyber attack-oekraine-offline-bedrijf-hostte-eerder-extreemrechtse-vizier-op-links

... of course, state hackers are targeting the defense industry.
https://www.cisa.gov/uscert/ncas/alerts/aa22-047a

… criminals assume the identity of the public health service to carry out their evil plans. [IN DUTCH]
https://ggdghor.nl/actueel-bericht/valse-mail/

… the Microsoft cloud faced the largest DDoS attack to date.
https://arstechnica.com/information-technology/2022/01/microsoft-fends-off-record-breaking-3-47-tbps-ddos-attack/

… it is not useful at all to steal cryptocurrencies. [IN DUTCH]
https://blog.iusmentis.com/2022/02/15/is-crypto-en-bitcoin-well-suitable-for-criminals-of-niet/

… the German hackers' club CCC has found a lot of personal data, including at our Ministry of Health, Welfare and Sport. [IN DUTCH]
https://tweakers.net/nieuws/193238/hackersclub-ccc-vindt-6-komma-4-mljoen-informatie-via-vijftigtal-datalek.html

… the Belgian privacy supervisor believes that a commonly used system for cookie pop-ups is in violation of the GDPR. [IN DUTCH]
https://blog.iusmentis.com/2022/02/08/supervisor-cookiepop-ups-advertising-industry-in-conflict-met-avg/

… Microsoft Office is now stricter on macros.
https://www.theverge.com/2022/2/7/22922032/microsoft-block-office-vba-macros-default-change

… you would do well to only accept new friends on LinkedIn that you already know from real life. [IN DUTCH]
https://tweakers.net/nieuws/192926/spionnen-leggen-via-linkedin-contact-met-nederlandse-werkers-techbedrijven.html

… European privacy regulators are investigating the use of the cloud by governments. [IN DUTCH]
https://autoriteitpersoonsgegevens.nl/nl/nieuws/privacytoezichthouders-onderzoeken- Use-clouddiensten-door-overheidsbedrijven

… the Ministry of the Interior and Kingdom Relations makes the use of the Logius cloud mandatory. [IN DUTCH]
https://www.logius.nl/actueel/ Standaard-platform-eerste-keus-voor-ontdeveloped-en-hosten-van-bzk-diensten

 

2022-02-04

Self-test

 

Image from Pixabay

A young family member is currently having a difficult relationship with testing. As a good schoolboy, he does a self-test twice a week and this week he hit the mark: two red lines.

 The family was in turmoil for a while, because they managed to keep COVID-19 outside two years. What measures must be taken? Who should be informed? And above all, quickly arrange the official test at the GGD! (The public health service in the Netherlands.) Well, the latter was quite a hassle: the GGD was fully occupied and the boy was referred to a commercial testing facility a city away. Strangely enough, he could go there on the same day, whenever he wanted. Afterwards, it became clear why this facility was perhaps a little less popular: they did a rapid test and they did it very sloppily. The result was negative, but this young man wasn’t convinced and that is why he also did another self-test at home. Hey, negative too!

 The next morning, just to be sure, he did a self-test. And guess what: positive! That family didn't know what to do anymore. The consulted assistant of the family doctor advised, after hearing the story, to do another test at a real GGD facility. With the caveat that self-tests rarely give a false positive, in other words: assume that you have COVID-19. In the evening, the patient – who fortunately had only mild complaints – was able to visit the GGD, which is more than half an hour's drive from his hometown. The result took a while to come. No one was surprised that it was positive.

 As an IT person I have a hard time with such inconsistencies. However, I learned a long time ago that even computers are not always consistent. Thirty years ago I programmed in COBOL on the mainframe. One of the programs I was in charge of was the so-called day work, which – strangely enough – was run at night (it was batch processing; all input from that day was processed in bulk overnight). One day, late at night, the phone rang: the day work had crashed. Something similar had happened long before that and then I, together with a colleague, sat in the office all night to solve the error (no you young people, one couldn't work from home in those days). I didn't feel like doing that again, so I told the operator to simply restart processing. Never heard of it again.

 Our security policy states that security features of a system should be tested, and that this also needs to be done after modifications to a system. When asked, the people who should be doing this tend to mumble that systems are of course tested, but only rarely do they fully agree that they pay explicit attention to the security functions. I know that’s difficult: they often have to deal with complex systems from various suppliers. The vast majority of those systems do not have security as their primary task; security features are often referred to as 'non-functionals'. Dear people, without security most information systems wouldn't be able to function at all, because we couldn’t trust them! So security is as functional as can be, albeit, admittedly, secondary to the tasks the system was built for.

 Testing is really necessary. You need to make sure that your processes and data are safe from curious but unauthorized colleagues, from hackers, from criminals and from spies. Sometimes a self-test is sufficient, sometimes you have to have a formal test done which is in fact a simulated hacking attack. For this we use nice terms such as attack & penetration test or the shorter penetration test (which in turn is abbreviated to pentest). Such tests are mandatory for us on all systems that are connected to the internet. We employ pen testers ourselves, but we also have contracts with external parties who do this work for us. When hiring pen testers, it is good to look at the reputation of both their employer and the individuals themselves. After all, you don't want these ethical hackers to overlook something that could be abused by a criminal hacker.

 Testing is not a binary activity: a negative result does not necessarily mean that there is nothing wrong and a positive result can also be a mistake. To make things worse, a negative result is received positively and a positive result is bad news. What genius thought that up?

This blog post has been translated from Dutch to English by Google and edited by the author.


 And in the big bad world…

This section contains a selection of news articles I came across in the past week. Because the original version of this blog post is aimed at readers in the Netherlands, it contains some links to articles in Dutch. Where no language is indicated, the article is in English.

... the GGD is still in a bad position with regard to privacy protection. [IN DUTCH]
https://www.destentor.nl/binnenland/ggd-laks-met-beschermen-privacy-oud-werker-kan-vanuit-huis-bij-jouw-data~a922a62b/

 … the Belgian Data Protection Authority has reprimanded the advertising industry.
https://www.dataprotectionauthority.be/iab-europe-held-responsible-for-a-mechanism-that-infringes-the-gdpr

 … your personal data can even leak through a font, and that is not allowed. [IN DUTCH]
https://blog.iusmentis.com/2022/02/03/duitse-website-verjudged-for-passing-ip-adress-visitor-via-google-fonts/

 … a German oil distributor IS paralyzed by cybercriminals. [IN GERMAN]
https://app.handelsblatt.com/unternehmen/energieversorgung-cyberangriff-legt-oiltanking-tanklager-deutschlandweit-vollstaendig-lahm-tankwagen-beladung-ausser-betrieb/28023918.html

 … an oil terminal in the Netherlands is also down. [IN DUTCH]
https://www.nu.nl/tech/6181835/olieterminal-terneuzen-kampt-met-laad-en-los problem-na-cyber attack.html

 … we never hear much about malware for the Mac, but this one has evolved quite a bit.
https://arstechnica.com/information-technology/2022/02/mac-malware-spreading-for-14-months-is-growing-increasingly-aggressive/

 … there was another noteworthy message about Mac malware.
https://arstechnica.com/information-technology/2022/01/booby-trapped-sites-delivered-potent-new-backdoor-trojan-to-macos-users/

 … Specter and Meldown celebrated their fourth birthday.
https://www.kaspersky.com/blog/spectre-meltdown-in-practice/43525/

 … cybercrime is still on the rise. [IN DUTCH]
https://www.nu.nl/tech/6181243/fraudehelpdesk-ziet-laag-van-nummer-meldingen-over-cybercriminatuur.html

 … the Olympic Games are (of course) at risk of cyber attacks.
https://www.bleepingcomputer.com/news/security/fbi-warns-of-2022-beijing-olympics-cyberattack-privacy-risks/

 … athletes, journalists and other visitors to China are warned about digital espionage by the host country. [IN DUTCH]
https://www.nu.nl/tech/6180427/spionage-ligt-in-china-op-de-loer-maar-op-reis-kan-digitale-voorzorg-nooit-kwaad.html

 … yet another cryptocurrency trading platform was robbed.
https://www.bleepingcomputer.com/news/cryptocurrency/wormhole-cryptocurrency-platform-hacked-to-steal-326-million/

 ... from now on, forensic institutes worldwide will speak the same cyber language. [IN DUTCH]
https://www.forensischinstituut.nl/actueel/nieuws/2022/02/02/nfi-een-van-de-grondleggers-van-universele-cybertaal-die-internationale-bestrijding-tegen-criminatuur-makes easier

 … cyber criminals are getting smarter and richer.
https://www.securityweek.com/cyber-insights-2022-improving-criminal-sophistication

 … you can of course throw your laptop out the window when the police are coming for you. [IN DUTCH]
https://www.nu.nl/tech/6181270/verdachte-van-phishing-gooit-laptop-uit-het-raam-bij-inval-in-amsterdam.html

 

2022-02-03

The weakest link

 


“We can't make humans that much better.” Is that a statement from an extraterrestrial, divine or not, who resignedly determines that man is 'finished' and that we have to make do with the current model? Is Generation Z (the 'Zoomers') our final destination and is that letter anything but coincidence?


Nonsense. It is a statement made by someone at a security conference and relates to the role of humans in the fight against digital crime. You know, phishing and stuff. The tenor of the story was that we've already put so much energy into raising the security awareness of our colleagues, friends, relatives and complete strangers that the job is now done – it doesn't get any better than this.


That is of course not true. At least not quite. We have to keep going with our mission anyway because new people are still appearing on the face of the earth. And those new people have to learn from an early age how to move safely through the digital world – through their world, because Generation Z is pretty much born with a smartphone in hand. This includes special attention to privacy. It’s so easy to give up your privacy completely with your own hands, even without doing it very consciously. The 'yes go' button is always bigger and nicer than the 'no' button when you get to choose whether a site can store cookies, whether an app can "sync" with your address book (a blatant euphemism for copying), whether they can use your location. 'Yes' is the easy answer, 'no' gives you extra work while you want to get started right now with that site or app.


In fact, it is not too bad with that extra work. If you indicate somewhere that you want to adjust the cookie settings, those settings should be set to 'off' by default. You then only have to click on 'save settings', without the burden of checking all those settings. But beware: here too a tempting button appears that says 'Allow all', next to a much less conspicuous link to save the chosen settings. In addition, at some settings you will also see a separate setting, which is called 'legitimate interest' and is turned on by default (or can't even be turned off). That term in quotation marks comes from the GDPR, in which legitimate interest is one of the legal bases for processing personal data. Companies often consider direct marketing to be a legitimate interest (“otherwise we can't make money”), but privacy experts don't seem to agree on that yet. By far the most pleasant to me are sites that, in addition to 'accept everything', also offer the option 'accept nothing'.


Some people are completely fed up with security and privacy. Those are the people who neither want nor can play along. Cyber ​​criminals often target the elderly, but it is far too easy to claim that the group lost to awareness activities is only populated by the elderly. My mother is 88 and very alert to digital craziness ("Patrick, what should I do with this?" is a regularly recurring text in WhatsApp, accompanied by an image of a screen on which a choice has to be made). In that regard, generations A to Z can still learn a lot from her. But there is not much credit to be gained from most total objectors. Incidentally, I know very little about them, but that may be because they are outside my bubble.


I brought back another quote from that same conference, which ties in nicely with the first: “People are not the weakest link, but the most vulnerable”. Look, that's a statement after my heart. You cannot blame an individual for the fact that technology is not yet sufficiently capable of protecting us against digital inconvenience. Humans are vulnerable in two ways: on the one hand, they are unable – just like security software – to unerringly separate the wheat from the chaff, and on the other, it is the same human being who will ultimately be the victim. Because even though it may initially be about hacking a computer, in the end it is about the files of or about people. Even when it comes to corporate espionage, people get hit, namely the people whose secrets are stolen.


So people are vulnerable, and it doesn't get much better if you combine the two quotes. I refuse to accept this, because apart from the total objectors, we can really achieve what is necessary through information and conviction, right across all generations. Let’s just do our best. 

Gyro Gearloose

  Image from Pixabay Gyro Gearloose is a crane after my own heart. He can invent a genius device to order, or he has something lying around ...