WPA3 Standard Officially Launches With New Wi-Fi Security Features

The Wi-Fi Alliance today officially launched WPA3—the next-generation Wi-Fi security standard that promises to eliminate all the known security vulnerabilities and wireless attacks that are up today including the dangerous KRACK attacks.

WPA, or Wi-Fi Protected Access, is a standard designed to authenticate wireless devices using the Advanced Encryption Standard (AES) protocol and is intended to prevent hackers from eavesdropping on your wireless data.

However, in late last year, security researchers uncovered a severe flaw in the current WPA2 protocol, dubbed KRACK (Key Reinstallation Attack), that made it possible for attackers to intercept, decrypt and even manipulate WiFi network traffic.

Although most device manufacturers patched their devices against KRACK attacks, the WiFi Alliance, without much delay, rushed to finalize and launch WPA3 in order to address WPA2's technical shortcomings from the ground.

What is WPA3? What New Security Features WPA3 Offers?

WPA3 security standard will replace the existing WPA2 that has been around for at least 15 years and widely used by billions of devices every day.

The new security protocol provides some big improvements for Wi-Fi enabled devices in terms of configuration, authentication, and encryption enhancements, making it harder for hackers to hack your Wi-Fi or eavesdrop on your network.

On Monday, the Wi-Fi Alliance launched two flavors of latest security protocol—WPA3-Personal and WPA3-Enterprise—for personal, enterprise, and IoT wireless networks.
Here are some key features provided by the new protocol:

1.) Protection Against Brute-Force Attacks

WPA3 provides enhanced protection against offline brute-force dictionary attacks, making it harder for hackers to crack your WiFi password—even if you choose less complex passwords—by using commonly used passwords over and over again.

2.) WPA3 Forward Secrecy

WPA3 leverages SAE (Simultaneous Authentication of Equals) handshake to offer forward secrecy, a security feature that prevents attackers from decrypting old captured traffic even if they ever learn the password of a network.

3.) Protecting Public/Open Wi-Fi Networks

WPA3 strengthens user privacy in open networks through individualized data encryption, a feature that encrypts the wireless traffic between your device and the Wi-Fi access point to mitigate the risk of Man-in-the-Middle (MitM) attacks. To prevent such passive attacks, WPA3 could add support for Opportunistic Wireless Encryption (OWE).

4.) Strong Encryption for Critical Networks

Using WPA3 Enterprise, critical Wi-Fi networks handling sensitive information (such as government, , and industrial organizations), can protect their Wi-Fi connections with 192-bit encryption.

Wi-Fi Easy Connect

Alongside WPA3, the WiFi Alliance has also announced  a new feature, called Wi-Fi Easy Connect, that simplifies the process of pairing smart home gadgets (without any screen or display) to your router.

Wi-Fi Easy Connect is a replacement for Wi-Fi Protected Setup (WPS), which has been considered insecure.

With the support for Easy Connect, you will be able to pair your smart gadget with the router by simply scanning a QR code with your smartphone to have the Wi-Fi credentials automatically sent to the new smart device.

It should be noted that both WPA3 and Wi-Fi Easy Connect will not hit the mainstream right away. In fact, it is going to be a many-years-long process that will require new routers and smart gadgets to support WPA3.

Therefore, WPA2 will not stop working any time soon, and devices with WPA3 support will still be able to connect with devices that use WPA2 for the working of your gadgets, but WPA3 support will eventually become mandatory as adoption grows.

WPA3 is set to roll out later this year and is expected to hit mass adoption in late 2019, when it eventually become a requirement for devices to be considered Wi-Fi certified, according to the WiFi Alliance.


Source:  TheHackerNews 

Android Gets New Anti-Spoofing Feature to Make Biometric Authentication Secure

Google just announced its plan to introduce a new anti-spoofing feature for its Android operating system that makes its biometric authentication mechanisms more secure than ever.

Biometric authentications, like the fingerprint, IRIS, or face recognition technologies, smoothen the process of unlocking devices and applications by making it notably faster and secure.

Although biometric systems also have some pitfalls that are not hidden from anyone, as it has been proven multiple times in the past that most biometric scanners are vulnerable to spoofing attacks, and in most cases fooling them is quite easy.

Google announced today a better model to improve biometric security, which will be available from Android P, allowing mobile app developers to integrate an enhanced mechanism within their apps to keep users’ data safe.

New Biometric Metrics to Identify Spoofing and Imposter Attacks

Currently, the Android biometric authentication system uses two metrics—False Accept Rate (FAR) and False Reject Rate (FRR)—in combination with machine learning techniques to measure accuracy and precision of the user's input.

In brief, 'False Accept Rate' defines how often the biometric model accidentally classifies an incorrect input as belonging to the targeted user, while 'False Reject Rate' records how often a biometric model accidentally classifies the user's biometric as incorrect.

Moreover, for user convenience some biometric scanners also allow users to authenticate successfully with higher false-acceptance rates than usual, leaving devices open to spoofing attacks.

Google says none of the given metrics is capable enough to precisely identify if biometric data entered by a user is an attempt by an attacker to make unauthorized access using any spoofing or impostor attack.

In an attempt to resolve this issue, in addition to FAR and FRR, Google has now introduced two new metrics—Spoof Accept Rate (SAR) and Imposter Accept Rate (IAR)—that explicitly account for an attacker in the threat model.

"As their names suggest, these metrics measure how easily an attacker can bypass a biometric authentication scheme," Vishwath Mohan, a security engineer with Google Android team, says.

"Spoofing refers to the use of a known-good recording (e.g., replaying a voice recording or using a face or fingerprint picture), while impostor acceptance means a successful mimicking of another user's biometric (e.g., trying to sound or look like a target user)."

Google to Enforce Strong Biometric Authentication Policies

Based upon user's biometric input, the values of SAR/IAR metrics define if it is a "strong biometric" (for values lower than or equal to 7%), or a "weak biometric" authentication (for values higher than 7%).

While unlocking your device or an application, if these values fall under weak biometric, Android P will enforce strict authentication policies on users, as given below:

It will prompt the user to re-enter their primary PIN, pattern, password or a strong biometric if the device is inactive for at least 4 hours (such as when left at a desk or charging).

In case, you left your device unattended for 72-hours, the system will enforce policy mentioned above for both weak and strong biometrics.

For additional safety, users authenticated with weak biometric would not be able to make payments or participate in other transactions that involve a KeyStore auth-bound key.

Besides this, Google will also offer a new easy-to-use BiometricPrompt API that developers can use to set up a robust authentication mechanism in their apps to ensure maximum security of their users by completely blocking weak biometric authentication detected by two newly added metrics.

"BiometricPrompt only exposes strong modalities, so developers can be assured of a consistent level of security across all devices their application runs on," Mohan said.

"A support library is also provided for devices running Android O and earlier, allowing applications to utilize the advantages of this API across more devices."

The new feature would positively prevent unauthorized access to devices from thieves, spies and law enforcement agencies as well by locking it down to cripple known methods to bypass biometric scanners.


Source:  TheHackerNews 

Google Solves Update Issue for Android Apps Installed from Unknown Sources

If you are wondering how to receive latest updates for an Android app—installed via a 3rd party source or peer-to-peer app sharing—directly from Google Play Store.

For security reasons, until now apps installed from third-party sources cannot be updated automatically over-the-air, as Google does not recognize them as Play Store apps and they do not show up in your Google account app list as well.

Late last year, Google announced its plan to set up an automated mechanism to verify the authenticity of an app by adding a small amount of security metadata on top of each Android application package (in the APK Signing Block) distributed by its Play Store

This metadata is like a digital signature that would help your Android device to verify if the origin of an app you have installed from a third-party source is a Play Store app and have not been tempered, for example, a virus is not attached to it.

From early 2018, Google has already started implementing this mechanism, which doesn't require any action from Android users or app developers, helping the company to keep its smartphone users secure by adding those peer-to-peer shared apps to a user's Play Store Library in order to push regular updates.

Additionally, Google yesterday announced a new enhancement to its plan by adding offline support for metadata verification that would allow your Android OS to determine the authenticity of "apps obtained through Play-approved distribution channels" while the device is offline.

"One of the reasons we're doing this is to help developers reach a wider audience, particularly in countries where peer-to-peer app sharing is common because of costly data plans and limited connectivity," said James Bender, Product Manager at Google Play. "This will give people more confidence when using Play-approved peer-to-peer sharing apps."

It should be noted that this feature doesn’t protect you from the threat of installing apps from third-party sources; instead, it merely helps you receive latest updates for apps if their origin is Google Play Store.

Last year, as part of its mission, to secure Android ecosystem, Google also added built-in behavior-based malware protection for Android devices, called Google Play Protect, which uses machine learning and app usage analysis to weed out the dangerous and malicious apps.

Google Play Protect not only scans apps installed from official Play Store but also monitors apps that have been installed from third-party sources.

Moreover, Play Protect now also support offline scanning, which suggests that it will take care of newly introduced metadata verification as well.

Although Play Store itself is not completely immune to malware, users are still advised to download apps, especially published by reputable developers, from the official app store to minimize the risk of getting their devices compromised.



Source:  TheHackerNews

Oppo's all-screen Find X hides a pop-up selfie camera

Almost every phone manufacturer is trying to develop a handset with a truly edge-to-edge display. Most end up with a small notch, but others are finding new and unusual ways to hide the front-facing camera. Oppo, for instance, has packed a tiny motorized mechanism into its brand new Find X flagship. At a glance, it looks like a regular phone with a 6.4-inch, 1080p display -- but as soon as you launch the camera app, the top section slides up to reveal a 25-megapixel selfie shooter and a dual-camera system on the back. Close the application and the cameras will automatically disappear again.

It uses this pop-up trick for face unlock, too, complete with iPhone X-style infrared depth detection (nicknamed O-Face -- no, really) to securely sign you in most any lighting condition. Other party tricks will seem familiar, too, including portrait lighting effects for both front and rear photos as well as Omoji, Oppo's take on Animoji.

Otherwise, though, the Find X is everything you would expect from a high-end smartphone in 2018. The display curves on the left and right, similar to Samsung's Galaxy S9 Plus, but covers an even larger 93.8 percent of the phone's front. Inside you'll find a Qualcomm Snapdragon 845 processor, 8GB of RAM and 256GB of internal storage. There's also a 3,730mAh battery that supports a quick-charge system similar to OnePlus (Oppo and OnePlus are basically the same company.) You'll find 20- and 16-megapixel rear cameras on the back with depth-of-field effects and AI-based scene recognition. The phone doesn't support wireless charging, however, and there's no headphone jack. On the software side, you're getting Android 8.1 Oreo with Oppo's Color OS interface.

Oppo is a huge vendor, but its influence is mainly tied to Asia. The Find X, though, will be the first phone that the company officially sells in North America (availability wasn't mentioned) and Europe (due in August for €999). That's a big deal, though it will need carrier partnerships to stand out. The slide-out camera is novel, but I suspect it won't be for everyone. It's not the most discreet system, for instance, and when it's visible the phone's design looks a tad unbalanced. Still, it's a neat workaround, and one that feels similar to the Vivo Nex's pop-up camera.

Oh, and if you need something even more powerful? There's an Automobili Lamborghini special edition for €1,699 that not only gives you the obligatory carbon fiber effect and raging bull logo on the back, but an even faster charging system. It uses a 10V, 50W SuperVOOC adapter to bring the phone to a full charge in just 35 minutes. That's utter overkill for most people, but at least you're getting more than just a cosmetic tweak and some pretty packaging.

Source:  Engaget 

Nearly Half of All Web Apps Vulnerable to Unauthorized Access

New research from Positive Technologies has discovered that almost half (48%) of web applications are vulnerable to unauthorized access, with 44% placing users’ personal data at risk of theft.

What’s more, 70% of the apps Positive Technologies tested proved susceptible to leaks of critical information, whilst attacks on users are possible in 96% of them.

In fact, every app the firm assessed contained vulnerabilities of some sort, with 17% having vulnerabilities that would allow an attacker to take full control over the app.

The majority of detected vulnerabilities (65%) were a result of errors in application development – such as coding errors – with incorrect configuration of web servers accounting for a third of them.

However, the research did discover the percentage of web apps with critical vulnerabilities (52%) had declined for the second year in a row, down from 58% the previous year.

“Web application security is still poor and, despite increasing awareness of the risks, is still not being prioritized enough in the development process,” said Positive Technologies analyst Leigh-Anne Galloway. “Most of these issues could have been prevented entirely by implementing secure development practices, including code audits from the start and throughout.”

Speaking to Infosecurity Eoin Keary, founder and CEO, edgescan, agreed that steps need to be taken to improve application layer security.

“DevSecOps needs to be embraced such that security is throughout the development pipeline,” he said. “Application component security management (software components used by developers) is still not common place in terms of supporting frameworks and software components and is a common source of vulnerability.”



Source:  Infosecurity 

Phishing Campaigns Target Sports Fans, Consumers

Two phishing campaigns have been targeting consumers of both the FIFA World Cup and one of its longtime partners, Adidas. One campaign attempts to lure victims into clicking on a malicious link under the guise of downloading a World Cup schedule of fixtures and a result tracker, while the second promises a “free” $50-per-month subscription for Adidas shoes.

Today Check Point announced that it has discovered a new phishing campaign linked to the start of the World Cup that targets soccer fans. A known malware that is often used to install potentially unwanted programs (PUPs) and toolbars, adware or system optimizers called DownloaderGuide is embedded in the attachment. Researchers discovered nine different executable files delivered in emails with the subject: “World_Cup_2018_Schedule_and_Scoresheet_V1.86_CB-DL-Manager.”

First identified on 30 May, Check Point said the campaign peaked on 5 June but has re-emerged since the start of the games. “Events that attract huge amounts of popular interest are seen by cyber-criminals as a golden opportunity to launch new campaigns,” Maya Horowitz, Check Point’s threat intelligence group manager, said in today’s press release.

“With so much anticipation and hype around the World Cup, cyber-criminals are banking on employees being less vigilant in opening unsolicited emails and attachments. As such, it is critical that organizations take steps to remind their employees of security best practices to help prevent these attacks being successful," Horowitz said.

The second phishing campaign, which targets Adidas customers, uses a different tactic, luring victims in with a homographic link that uses a vertical line in place of where the “i” in Adidas should be. “The use of punycode-based homoglyph email and web domains are an increasingly used technique to spoof users in email phishing attacks,” said Matthew Gardiner, cybersecurity expert, Mimecast.

“Given the thousands of possible iterations of a domain that are now possible with these internationalized domain names and the thousands of available top-level domains that are also available, such as .co, .cf, .ml and many others, there is no possibility of preregistering these domains to keep them out of the hands of the bad actors. The only reasonable approach is to have automated email security controls to detect these types of impersonation attacks to protect your organization. Expecting your users to figure it out is increasingly unrealistic,” Gardiner said.

Source: Infosecurity 

Chinese Hackers Target National Datacenter in Watering Hole Spree

Researchers have uncovered a Chinese APT campaign designed to compromise government websites in a Central Asian nation by targeting a key datacenter.

Kaspersky Lab explained that by compromising the national datacenter, the APT27/LuckyMouse/EmissaryPanda group was able to gain “access to a wide range of government resources at one fell swoop.”

“Government entities, including the Central Asian ones also were a target for this actor before,” it added. “Due to LuckyMouse’s ongoing water-holing of government websites and the corresponding dates, we suspect that one of the aims of this campaign is to access web pages via the datacenter and inject JavaScripts into them.”

It’s not clear how the attackers targeted the datacenter in the first instance. Although they have used weaponized documents exploiting CVE-2017-118822 in the past, Kaspersky Lab believes employees may have been targeted by watering hole attacks.

Interestingly, the main command and control IP address was traced back to a Ukrainian ISP running a Mikrotik router that was hacked “in order to process the malware’s HTTP requests.”

The websites themselves were compromised to redirect visitors to instances of both ScanBox and BEeF. The former is a reconnaissance framework that collects information about the victim’s machine, including operating systems, language and location.

BEeF — the Browser Exploitation Framework — is a pen testing tool focused on the browser.

“The TTPs for this campaign are quite common for Chinese-speaking actors, where they typically provide new solid wrappers (launcher and decompressor protected with shikata_ga_nai in this case) around their RATs (HyperBro),” Kaspersky Lab concluded.

“The most unusual and interesting point here is the target. A national datacenter is a valuable source of data that can also be abused to compromise official websites. Another interesting point is the Mikrotik router, which we believe was hacked specifically for the campaign. The reasons for this are not very clear: typically, Chinese-speaking actors don’t bother disguising their campaigns. Maybe these are the first steps in a new stealthier approach.”



Source:  Infosecurity