Information Security News
by Andrew Cunningham
Last year, Google made headlines when it revealed that its next version of Android would require full-disk encryption on all new phones. Older versions of Android had supported optional disk encryption, but Android 5.0 Lollipop would make it a standard feature.
But we're starting to see new Lollipop phones from Google's partners, and they aren't encrypted by default, contradicting Google's previous statements. At some point between the original announcement in September of 2014 and the publication of the Android 5.0 hardware requirements in January of 2015, Google apparently decided to relax the requirement, pushing it off to some future version of Android. Here's the timeline of events.
Google's decision to encrypt new Lollipop devices by default was reported widely, in both tech-focused and mainstream publications.
Klaus Vesthammer recently tweetedthat ">The Internet of Things is just like the regular Internet, just without software patches. We have a flood of announcements about vulnerable devices, and little in terms of patches. At the same time, expect more and more of these devices to be connected to your network, if you want it or not. Bring your own Devices should be addressed more inclusive then just covering smart phones and tablets.
If you do have a working inventory system that recognizes and blocks unauthorized devices in real time, then stop reading and count yourself lucky. But for most of us, network maps are filed under fiction and network access control was this great solution we tried and failed as it hit real network life. So what else is there to do?
One of the critical aspects is to figure out which devices are not just on your network, but also do they talk to systems outside of your network. Active scanning will only get you that far. Many devices, to save power, will not connect to the network unless they have something to say. Some also use bluetooth to connect to smartphones and use them as a gateway. The device will not show up as an entity on your network in this case.
Here are a couple of indicators to look for:
- NTP queries: Some devices do have hard coded NTP servers, that do not match your standard network configuration
- DNS queries: DNS knows everything
- HTTP User-Agent and Server headers
Someone I am sure will provide pointers to do this in Bro. For everybody else, some simple log parsing scripts can help. Any other methods your use to find new and dangerous devices on your network?
Posted by InfoSec News on Mar 02http://motherboard.vice.com/read/why-silicon-valley-hackers-still-wont-work-with-the-military-and-vice-versa
Posted by InfoSec News on Mar 02http://mashable.com/2015/03/01/australia-politicians-wickr/
Posted by InfoSec News on Mar 02http://krebsonsecurity.com/2015/03/natural-grocers-investigating-card-breach/
Posted by InfoSec News on Mar 02http://www.theregister.co.uk/2015/03/02/bad_movie_hackers_can_raid_networks_with_burnt_blurays/
Posted by InfoSec News on Mar 02http://www.eweek.com/security/anthem-breach-evidence-points-to-china-security-researchers-say.html
Monday review - the hot 26 stories of the week
Tags: "cybersecurity awareness", Infosec, monday review. How likely are you to recommend Naked Security to a friend or colleague? 0 1 2 3 4 5 6 7 8 9 10. Vote. Take Our Poll · Bought PII from the government? PLEASE DON'T LOSE IT! 60 Sec Security ...