Bad passwords, bad bugs, a threat to high-performance computers and more.
Welcome to Cyber Security Today. It’s Friday, February 5. I’m Howard Solomon, contributing reporter on cybersecurity for ITWorldCanada.com. To hear the podcast click on the arrow below:
 |
 |
 |
People are getting better at creating safer passwords, but bad habits for many are still common. That’s the conclusion of a blog this week from the security firm ID Agent. It looked at the top 20 most common passwords found for sale on the dark web last year and number one was… the consecutive number ‘123456.’ The second most common was the word ‘password.’ and the third most common was the consecutive number ‘12345678.’ Not everyone uses these commonly-guessed passwords or combinations. The company figures 59 per cent of Americans use a person’s family name or family birthday in their passwords. Last year the most common name was ‘maggie.’ In 2019 it was ‘george.’ If a hacker is targeting you one of their first guesses will be your name. Also common for people to use are words pulled from a dictionary. That’s why in addition to trying commonly stolen passwords and names, cyber crooks will try an automated dictionary attack, which tries to login using every word in the dictionary. So forget about using a favourite food, place or animal as a password. Same thing with sports teams. Please don’t use shortcuts. Chose a three-word phrase as a password, and keep it in a software password manager. That way all you have to remember is the one password that unlocks the manager. And to add extra protection enable multifactor authentication to your logins.
Here’s some interesting numbers from a survey of Canadian businesses by a firm called Novipro: Respondents said 35 per cent of the cyber incidents they suffered were caused by an employee. Of those 18 per cent were caused accidentally.
A vulnerability intelligence company called vFeed has put out a list of the top 10 software vulnerabilities that were exploited in 2020. These are the bugs in applications that cyber crooks most often went after when trying to break into computer systems. Six of them involve Windows or Microsoft Exchange. As far as I can tell all 10 of them have been patched. One of the best things your organization can do to lower the odds it gets hacked is to install security patches as soon as they are released.
Governments, companies and universities running high performance Linux clusters should be on the lookout for malware targeting their systems. Security firm ESET calls this threat Kobalos, and describes it as malware that installs a backdoor so hackers can get into systems. One of the first things the malware does is steal server login credentials. That gives attackers access to other servers on the computer network. Network managers may be able to detect Kobalos by looking for non-encrypted traffic on a port supposed to be handling an encrypted SSH server. As is often the case, it also helps to have two-factor or multifactor authentication to protect servers if administrator login credentials are stolen.
Amazon’s Ring doorbell and video camera system has been criticized by privacy advocates for not making it cyber secure. In response Ring is rolling out a feature that encrypts the WiFi video feed that goes from the camera to your smartphone. That way the video can’t be intercepted by others. However, a column this week by the Electronic Frontier Foundation points out you have to turn the capability on. Your phone will generate a safe passphrase for logins. Remember that depending on the jurisdiction where you live, police may be able to get a warrant to see your front door video to help in an investigation on your street. Without encryption police could get video from Amazon, because it stores the video feed. After you enable encryption police can get a warrant for your video, but will probably have to let you know by serving you with the warrant.
Finally, a couple of security updates to tell you about. Researchers at Cisco Systems found a couple of vulnerabilities in an application called SoftMaker Office PlanMaker, a front end for Microsoft Excel spreadsheets. Install the latest patch or attackers could mess up your documents.
Cisco has issued patches for its Small Business VPN Routers to fix vulnerabilities in their firmware.
And Google is rolling out an update to its Chrome browser to fix a high severity vulnerability.
Don’t forget the Week In Review podcast will be out this afternoon after 3 p.m. Eastern. Today I’ll be discussing security metrics with guest Dinah Davis of Arctic Wolf.
Links to details about these stories can be found in the text version of this podcast at ITWorldCanada.com. That’s where you’ll also find more of my news stories aimed at cybersecurity professionals.
Subscribe to Cyber Security Today on Apple Podcasts, Google Podcasts or add us to your Flash Briefing on your smart speaker.