Last year, Google made headlines when it revealed that its next version of Android would require full-disk encryption on all new phones. Older versions of Android had supported optional disk encryption, but Android 5.0 Lollipop would make it a standard feature.

But we're starting to see new Lollipop phones from Google's partners, and they aren't encrypted by default, contradicting Google's previous statements. At some point between the original announcement in September of 2014 and the publication of the Android 5.0 hardware requirements in January of 2015, Google apparently decided to relax the requirement, pushing it off to some future version of Android. Here's the timeline of events.

Loud announcement, quiet backtracking

Google's decision to encrypt new Lollipop devices by default was reported widely, in both tech-focused and mainstream publications.

Read 11 remaining paragraphs | Comments


Klaus Vesthammer recently tweetedthat ">The Internet of Things is just like the regular Internet, just without software patches. We have a flood of announcements about vulnerable devices, and little in terms of patches. At the same time, expect more and more of these devices to be connected to your network, if you want it or not. Bring your own Devices should be addressed more inclusive then just covering smart phones and tablets.

If you do have a working inventory system that recognizes and blocks unauthorized devices in real time, then stop reading and count yourself lucky. But for most of us, network maps are filed under fiction and network access control was this great solution we tried and failed as it hit real network life. So what else is there to do?

One of the critical aspects is to figure out which devices are not just on your network, but also do they talk to systems outside of your network. Active scanning will only get you that far. Many devices, to save power, will not connect to the network unless they have something to say. Some also use bluetooth to connect to smartphones and use them as a gateway. The device will not show up as an entity on your network in this case.

Here are a couple of indicators to look for:

- NTP queries: Some devices do have hard coded NTP servers, that do not match your standard network configuration
- DNS queries: DNS knows everything
- HTTP User-Agent and Server headers

Someone I am sure will provide pointers to do this in Bro. For everybody else, some simple log parsing scripts can help. Any other methods your use to find new and dangerous devices on your network?

Johannes B. Ullrich, Ph.D.

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
LinuxSecurity.com: Updated cups packages fix security vulnerability: A malformed file with an invalid page header and compressed raster data can trigger a buffer overflow in cupsRasterReadPixels (CVE-2014-9679). [More...] _______________________________________________________________________
LinuxSecurity.com: USN-2516-1 introduced a regression in the Linux kernel.

Posted by InfoSec News on Mar 02


By Kari Paul
February 26, 2015

In the fight to defend cyberspace from its enemies, the US military is
rushing to hire as many skilled hackers as it can. But no one is really
sure how to get the two cultures to coexist.

Although the feds have implied they’re willing to loosen up some of their...

Posted by InfoSec News on Mar 02


By Jenni Ryall
March 1, 2015

Australian politicians are reportedly using the secret messenging app
Wickr to communicate with each other on the sly.

According to The Australian, Communications Minister Malcolm Turnbull and
Minister for Social Services Scott ­Morrison have been using the service
to communicate about their dissatisfaction with Prime Minister Tony Abbott...

Posted by InfoSec News on Mar 02


By Brian Krebs
Krebs on Security
March 2, 2015

Sources in the financial industry tell KrebsOnSecurity they have traced a
pattern of fraud on customer credit and debit cards suggesting that
hackers have tapped into cash registers at Natural Grocers locations
across the country. The grocery chain says it is investigating “a
potential data security incident...

Posted by InfoSec News on Mar 02


By Darren Pauli
The Register
2 Mar 2015

British hacker Stephen Tomkinson has found two Blu-Ray-borne attacks.

His first exploit relies on a poor Java implementation in a product called
PowerDVD from CyberLink. PowerDVD plays DVDs on PCs and creates menus
using Java, but the way Oracle's code has been used allows naughty folk to

Posted by InfoSec News on Mar 02


By Robert Lemos

A new open-source intelligence analysis of the breach of health insurer
Anthem has reinforced theories that the data theft leads back to a Chinese
espionage program, security firm ThreatConnect stated on Feb. 27.

In the report, which is based on public sources or "open-source"
[ MDVSA-2015:049 ] cups
[CVE-2015-1583] ATutor LCMS - CSRF Vulnerability in Version 2.2
BEdita CMS - XSS & CSRF Vulnerability in Version 3.5.0

Monday review - the hot 26 stories of the week
Naked Security
Tags: "cybersecurity awareness", Infosec, monday review. How likely are you to recommend Naked Security to a friend or colleague? 0 1 2 3 4 5 6 7 8 9 10. Vote. Take Our Poll · Bought PII from the government? PLEASE DON'T LOSE IT! 60 Sec Security ...

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Internet Storm Center Infocon Status