Tag Archives: security

Amazon has obliged drivers in the US to agree to collect data from cameras in vans – otherwise, they will not be able to deliver packages

Reading Time: 2 minutes

The company installed the cameras in February 2021, explaining that they were needed for safety.

Drivers of Amazon’s delivery service in the US must now sign a “biometric consent” form in order to continue working for the company [1], The Verge writes on March 24.

It involves agreeing to collect data from cameras installed in delivery vans. Drivers must agree to the use of “certain technology, including cameras” as a “condition of delivering packages for Amazon,” [2] according to Vice.

The drivers in question are those who rent Amazon vans under the Partner Service Delivery programme. According to Vice, about 75,000 drivers could be affected.

What kind of data the company will collect depends on what kind of equipment is installed in the vans, The Verge suggests. But the agreement implies a wide range of data to be collected. This includes cameras using facial recognition to confirm driver identity and connect to an account, according to Vice.

Among those collected, for example, is data on the van’s movement, including speed, acceleration, braking, turns and distance travelled, “potential traffic offences” such as speeding or unbuckling a seatbelt. As well as “potentially dangerous driving behaviour” – when the driver is distracted from the road or falling asleep.

The company says it installs the cameras for “safety” and “to improve delivery”. But some drivers have already refused to sign the agreement.

  • Amazon installed [3] artificial intelligence cameras in vans rented by drivers participating in the Partner Service Delivery programme in February. They have built-in software that can detect 16 different safety issues, including if drivers are distracted, speeding, braking sharply and more.
  • In early March, senators from five US states wrote to Amazon [4] saying that the use of surveillance cameras in delivery vans “raises important privacy and worker oversight issues that Amazon must respond to”.
  • In September 2020, human rights activists had already spoken out about the hard work at Amazon – for example, the company has an electronic employee monitoring system, there are cameras in warehouses and drivers’ locations are constantly recorded.

Sources:

[1] https://www.theverge.com/2021/3/24/22347945/amazon-delivery-drivers-ai-surveillance-cameras-vans-consent-form

[2] https://www.vice.com/en/article/dy8n3j/amazon-delivery-drivers-forced-to-sign-biometric-consent-form-or-lose-job

[3] https://www.cnbc.com/2021/02/03/amazon-using-ai-equipped-cameras-in-delivery-vans.html

[4] https://www.cnbc.com/2021/03/03/senators-question-amazon-about-cameras-monitoring-delivery-drivers.html

#technews #transport #amazon #ai #privacy #security

Tagged , , , ,

Microsoft Teams phishing campaign attack on O365 Users

Reading Time: 3 minutes

Image shows capabilities of Microsoft teams- a Network of sharing files, calendar, emotions, statics, comment, and mails.

© Image inserted from Microsoft News – news.microsoft.com

 

Due to the COVID-19 situation many Governments, Organisations, and businesses transform into online communication platforms or integrate into their system and use it as a primary communication channel. Universities and academic institutions all around the world also decide for a sudden shift to online learning in a short period of time.

According to the New York Times analysis of internet usage in the US and special services that allow us to work and learn from home increasing continuously.

 

© Image Screenshot from NY Times – App popularity according to iOS App Store rankings on March 16-18. · Source: Apptopia

 

At Kozminski our main communication channel is Microsoft Teams, MS Teams is one of the products of O365, and a very popular subscription services that MS offer academic institutions among Google G Suite, Zoom for Education, and many more.

Cloud-based communication platform security is a huge threat that we as a student, employer, and user-facing threats daily, it’s clear to us there is no perfection in SaaS. Startup, Footprint, Runtime, Responsiveness, Hangs, rendering, and so many more that we use to hear as BUGS, but Security Bugs is one of the scariest to end user because makes us a vulnerable and the main target.

Abnormal Security researchers warn of a phishing campaign that pretends to be an automated message from MS teams, but actually aims to steal the credentials of O365 recipients.

Phishing is a fraudulent attempt to obtain sensitive information or data, it’s a very popular and old technique of attack. This campaign attack was sent to 15,000 – 50,000 O365 users according to researchers with Abnormal Security

“Because Microsoft Teams is an instant-messaging service, recipients of this notification might be more apt to click on it so that they can respond quickly to whatever message they think they may have missed based on the notification,” said researchers in a Thursday analysis.

The phishing Email displays the name “There’s new activity in teams”, making look like it’s an automatic notification from Microsoft Teams.

As can be seen in the picture below, the email tells the recipient that his teammates are trying to reach him, warns him that he has missed the MS Teams Chat and shows an example of a teammate chat where he is asked to submit something.

 

Email Attack: The email is sent from the display name, ‘There’s new activity in Teams’, making it appear like an automated notification from Microsoft Teams.

© Image inserted from Abnormal Security

 

It’s certain that Using 2FA or Multi-FA will make an important additional layer, low coast solution In many cases, it does stop phishing attacks from succeeding but it doesn’t mean your are immune to attacks. Also according to MS365 administration official documentation first task is to “Set up multi-factor authentication” and apply to the user as required widely within the organization and the Second task “Train your users” Also Microsoft recommended The Harvard Kennedy School Cybersecurity Campaign Handbook guidance.

In my opinion, due to rapid changes and system integration, most IT Teams can not feed their users enough information and updates, and it’s time for us as the end-user to watch tutorials to familiarises ourselves and read more informations about our daily software/tools.

And here is to learn more about how to set up 2FA on your Microsoft account Step by Step

The Image show steps, how 2FA works on clients point of view.

© Image inserted from ZUKO TECH – Two-factor authentication (2FA)

 

Resource: Abnomal Security

MS = Microsoft Teams   –   O365 = Office 365   –   2FA = Two-Factor Authentication

Tagged , , ,

How facial recognition works

Reading Time: 3 minutesNowadays facial recognition systems become more and more popular. They are used by many companies, as well as certain countries as a way of detecting citizens. But how does facial recognition work?

Facial recognition is defined as a biometric software application with the ability of identifying a person by comparing their facial structure and patterns with data stored in a database. Every person has a unique facial pattern, and when other humans may not be able to easily distinguish it, software applications are capable of doing it within seconds. There are four steps that the software uses to recognise someone’s face.

Firstly, the camera will detect and recognize a face of a certain person, either when the person is alone, or in a crowd. Before there was a problem that occurred when the camera was not pointed directly at the front of the face, but nowadays the algorithm learned to deal with that issue.

Secondly, the photo of the face is taken and analysed. The software analyses over 80 facial features that differ from person to person, which are referred to as nodal points. Some of those features are obvious, such as shape of the eyes, but some of them are a lot more difficult to distinguish, for example distance between the eyes, shape and height of the cheekbones, or width of the nose.

After that, the analysis of the face is turned into lines of code and mathematical formulas. The features become numbers, and the code is referred to as faceprint. Just like with thumbprint, each person has unique faceprint.

After the code is obtained, it is compared with database of faceprints. The databases have millions of photos with necessary information. For example, the FBI has access to over 641 million photos. That includes 21 state databases, such as DMV, which are state level agencies that administer vehicle registration and driver licencing. The FBI also has access to Facebook’s databases, which store millions of photos tagged with person’s name. The software identifies matching information with data provided by databases. It then returns the match with attached personal information, such as name, age, address or even friends and family.

So where is facial recognition used? As you can probably imagine, there are great advantages of using the software in security purposes. Many airports all around the world use it to identify potential dangers. Facial recognition is also used in device security. Many new phones offer a possibility to use your face to unlock the phone, instead of using a pin code or symbol.

As you can probably guess, there are many ongoing controversies concerning facial recognition. Some people claim that it is an invasion of privacy. Other claim that it doesn’t work properly or can be easily deceived. The main concern surrounding facial recognition is that the data gathered by the software and stored in databases might get leaked or simply hacked and used with malicious intent.

In conclusion, facial recognition technology brings lots of possibilities in terms of safety and security, as long as the data itself stays secure. The possible misuses of such data are endless and might cause a serious danger in the future.

References:

https://en.wikipedia.org/wiki/Facial_recognition_system

www.pandasecurity.com/mediacenter/panda-security/facial-recognition-technology/

Tagged , , ,

50 000 Printers hacked in order to prolong PewDiePie’s number one spot on YouTube.

Reading Time: 3 minutes

Felix Kjellberg, a swedish YouTuber known as PewDiePie, is in the middle of a “YouTube subscribers war” where the prize is the number on spot considering the amount of subscribers on a channel. The war is fought between him and T-Series, an Indian media company which does bollywood music videos. Right now T-Series is the fastest growing channel on YouTube and has the number one spot regarding video views.

We’ve seen lots of posts, tweets, videos with people preaching the message of helping Felix remain the number one by subscribing to him, we’ve even had another YouTuber buy billboards to spread the message.

But this is like nothing before. Twitter user known as TheHackerGiraffe has found an exploit that enabled him to hack 50 thousand printers. First words about it came from twitter where people thought it was actually PewDiePie’s propaganda. PewDiePie took a bit of hate to the face because of this, but not enough to affect him – it’s not the first time and not the last time he gets bullied.

 

Because of this event the subscriber war took a twist and PewDiePie is still number one but not for long since T-Series is growing 4 times quicker. Here’s a live sub counter from YouTube provided by FlareTV

A bit about the technical side of the “hack”.

“TheHackerGiraffe scanned the Internet to find the list of vulnerable printers with port 9100 open using Shodan, a search engine for internet-connected devices and exploited them to spew out a message.

The hacker mainly uses an open-source hacking tool to exploit vulnerable printers, called Printer Exploitation Toolkit (PRET), which has been designed for testing printers against various known vulnerabilities, allowing attackers to capture or manipulate print jobs.”

The Hacker News

Apparently this is more of a trick than a hack. It’s not very complicated and it’s already been done by a hacker called Weev in 2016 in order to broaden antisemitism and by another hacker in 2017 who just printed silly drawings on around 150 000 printers.

TheHackerGiraffe in his AMA on reddit claimed that he hacked only 50 000 out of 800 000 potential printers that are still exposed to attacks. In perspective, that’s a lot of printers to be used in a bad way like phishing, blackmailing or just simply abusing it. It shows how insecure IPP/LPD printers are – especially when they’re not up-to-date. To somehow portray how easy this attack may be TheHackerGiffare wrote:

Think of it as a giant print button on the internet.

Having this power in his hands our “Friendly Giraffe” instead of abusing it he decided to help a YouTuber he liked and out of all the options he had – he decided to send the following message:

It’s a good way to raise awareness about security. This trick could have cost companies a lot of money since ink and paper doesn’t come for free. On top of that a trick like that could be pulled off by a kid and they could suffer consequences because of that. It is said that all a hacker need is your Fax number to hack your printer. At the end of the day a fun little game of a subscriber war has thought us a lesson about our security.

S:
https://thehackernews.com/2018/11/pewdiepie-printer-hack.html
https://www.zdnet.com/article/twitter-user-hacks-50000-printers-to-tell-people-to-subscribe-to-pewdiepie/
https://www.reddit.com/r/AMA/comments/a1wo96/i_hacked_50000_printers_worldwide_out_of/
twitter

Tagged , , , , , , ,

The Future of Security – Highlights from O. Brodt’s speech at Masters&Robots Conference 2017

Reading Time: 5 minutesOleg Brodt works at Deutsche Telekom Innovation Labs in Israel. He comes from the small city called Beersheba, also spelled Beer-Sheva, which also is the largest city in the Negev desert of southern Israel. In the end of October this year he spoke at Masters&Robots Conference in Warsaw, and I would like to present some of the highlights of his speech on cyber security.

 

1. Beersheba – as a Cyber Security Center of Israel

Israeli government decided that Beersheba is going to be a cyber security capital of Israel (being more than 4 times smaller than Warsaw). Therefore, all the cyber security units of military and other agencies were moved to this city. That is what made a great impact on Beersheba’s development and stimulated the inflow of human capital into the city. Nowadays there are 40 multinational companies located in Beersheba. There are also many accelerators, incubators, around 100 Start-Ups and the Ben-Gurion University, which is the only university in Israel offering a cyber security degree. Generally, there are around 400 Start-Ups focused on cyber security in Israel, furthermore, the country attracts 15% of global venture capital financing of cyber security projects.

Beersheba 2007

Beersheba 2017

 

 

 

 

 

 

 

2. Cyber Security Kids – Israeli Programs for Talented Pupils

In Israel children, who are good at math and IT, have a chance to become a part of the educational programs, which are aimed to prepare human resources for Israeli military units. Those are usually kids, who go to 9th grade. If the kid is cherrypicked, he or she attends the after school classes on cyber security twice a week during four years of high school and after this, he or she joins the army unit.

By the time a child finishes a school, he or she is already an expert in cyber security. Moreover, there is a 6-months gap between the kid finishes school studies and joins the military agency, and during that gap, a kid already works on military CS projects in IT labs. Those are the lowest qualified workers in Israeli IT Labs. The IT labs are being headed by professor Yuval Elovici, who is a known academic figure in the field of CS.

3. There are Different Kinds of Attackers in CS

  • Kids (“Script Kiddies”) – just children, who are bored, they have spare time and technical skills to hack you. They have some basic knowledge, and start to play around with CS, however, they are lowly qualified and normally can not do a lot of harm. Moreover, kids are hacking for “FUN”, there is no real money interest in it.
  • State Actors – governments, which hack each other or specific targets. They are extremely highly qualified, and if you are the target – it will be very difficult to defend. Also, they have “unlimited resources” to hack you, which means they are very dangerous and if they really want to hack you, it is a question of time.
  • Cybercriminals – revenue driven hackers, who aim to get a financial benefit from you.
  • Hacktivism – is the subversive use of computers and computer networks to promote a political agenda or a social change. Perhaps the most prolific and well known hacktivist group, Anonymous has been prominent and prevalent in many major online hacks over the past decade.
  • Terror Organizations – not very active in the field of CS yet, but are increasing their activity gradually.

4. Financial Models of Attackers

There are also different ways attackers might harm you and there are some of them:

  • Ransomware – a type of malicious software from cryptovirology that threatens to publish the victim’s data or perpetually block access to it unless a ransom is paid. While some simple ransomware may lock the system in a way which is not difficult for a knowledgeable person to reverse, more advanced malware uses a technique called cryptoviral extortion, in which it encrypts the victim’s files, making them inaccessible, and demands a ransom payment to decrypt them.
  • DDOS-as-a-Service – a new service in the Darknet. If you want to attack your competitor in the internet (for example internet shop), you order such a service in the Darknet from qualified hackers, and than they attack the e-commerce platform of your competitor in a way that it gets too many requests and falls offline.
  • Crypto-Hacks – is something relatively new, and means that hackers attack bitcoins exchangers in order to still their money.
  • Darkweb hacking services – there are even whole price lists for certain violations in the Darkweb. For example, how much does it cost to buy a thousand credit cards, or to hack somebody’s Facebook account.

5. It Is Not Personal – When Hacking You is a Business

  • The hackers, who attack you because of financial motivation are interested only in getting the money. They really do not care who you are, they are not hacking you because you are you, they are hacking you because of your resources. And the most popular way to hack during last two years is ransomware. Due to its “commonness”, there starts to arise a commoditization of the services connected to ransomware, so to say. In other words, hackers, who attack you with ransomware have support centers! So, for example, if you get hacked, and your entire organization data in currently encrypted, you get a message that you have to pay a ransom in bitcoins, but you do not know what actually bitcoin is – you may address hackers’ customer service for help. Yes, you get a phone number on your screen, and if you call on this number – a nice customer service representative guide you through the whole process. Sounds nice, hah?
  • Organizations, which are specialized in negotiations with hackers arise. For example: you are being hacked, and the attacker wants you to pay 5000$ ransom for your files. But how can you know that after the transfer of the money the files will be released? That is where negotiations companies come into play. First, they try to establish a reputation of the hacker – they ask him questions like: “How do I know that you are not going to publish my files in the Darkweb?” or “How do I know that you are not going to sell my files to other organizations?” And what happens next is something surprising – hackers give lists of “previous customers” (people or organizations, which were hacked by them before) to convince the victim that the deal is safe. They also propose to refer to those “customers” to get a recommendation. So there exists so-called recommendation base for hackers, in which new negotiations companies are specialized.

Sources:

  • https://en.wikipedia.org/wiki/Ransomware
  • https://en.wikipedia.org/wiki/Beersheba
  • Oleg’s Brodt Speech at Masters&Robots Conference in Warsaw (26-27 October 2017)

 

Tagged , , ,

Samsung introduces iris scanner to phones

Reading Time: 2 minutesIn this July 28, 2016, photo, Jonathan Wong of Samsung's Knox Product Marketing, shows the iris scanner feature of the Galaxy Note 7, in New York. Samsung releases an update to its jumbo smartphone and virtual-reality headset, mostly with enhancements rather than anything revolutionary during a preview of Samsung products. (AP Photo/Richard Drew)

Samsung firstly patented new approach to iris scanning and now introduced it to their new Galaxy Note 7 smartphone.  This technology in Samsung approach allows to protect access to device and data on it in a very convenient way and at the same time it is very secure.

Similarly, to earlier mentioned on the Koźmiński Tech Blog (http://techblog.kozminski.edu.pl/2015/10/30/eyeball-password/) this technology uses the human eye in order to identify authorized person. The difference is in its by far smaller size, lower price, and improved security.

Based on the presentation from past month held in London scanning process takes a second and require a user to look with both eyes open straight on the phone from 25 to 35 cm distance.

The device captures image of the face and iris this ensures even greater security.

Samsung Galaxy Note 7 iris scanner consists of IR LED and Iris camera. The Iris camera utilizes a special filter to receive reflected image of an iris achieved by illuminating it with IR LED light. The infra-red light ensures very good range for iris scanning which is not affected by color or ambient light which is typical in traditional technology.GalaxyNote7_Feature_Iris_Main_Final_3_2

Captured image is extracted and digitalized in order to compare it to digitalized pattern. If it matches the encrypted code grants the access. Thanks to this (a rather common move used for example by apple in its fingerprint scanning) no image of the actual iris is stored on the device and because of it cannot be taken from the device. This makes it more secure and protects the privacy of user as none of his photos are being used only digitalized patterns.

Based on Samsung description of sensor “iris scanning requires fewer trials and results in fewer false acceptance than fingerprint scanning”.

The technology will be used to grant access to the device, protect programs and data on the dedicated folder, will enable quick login into websites (using Samsung Pass on Samsung Internet Browser). Moreover, Samsung is also establishing partnerships with major banks in order to provide payment options using their biometric authentications utilizing iris scanning.

How do you fill about iris scanning method proposed by Samsung? Do you see it totally replacing fingerprint scanning in very near future?

Sources:

https://news.samsung.com/global/in-depth-look-keeping-an-eye-on-security-the-iris-scanner-of-the-galaxy-note7http://www.androidauthority.com/samsung-galaxy-note-7-iris-scanner-works-706979/

Tagged , , , ,