Cloud Hosting

While obtaining a new piece of tech hardware over the holidays can be exciting, it's not without risks, because in many cases, the default delivery state of the shiny new thing offers very little in the way of cyber security.

That means connecting your new product to the internet straight out of the box without taking security precautions could leave you open to hacking, cyber attacks and malware - all of which could put your data and privacy at risk.

To help users enjoy their new devices safely, the UK's National Cyber Security Centre (NCSC) the cyber arm of the GCHQ intelligence service has detailed five simple steps which can help make devices more secure.

1. Protect it with a strong password

People often believe that cyber criminals need to be expert sleuths to crack people's passwords, but the reality is that people use weak passwords which are easy to guess. It could be that they're using the default password which comes with the new device, or it could be that they're using common or easily guessable weak passwords like '12345' or 'password' for their email, shopping and social media accounts.

That's why the NCSC says that users should change simple or default passwords to a more secure one, so that it's not so easy for cyber criminals to guess. One way the NCSC suggests doing this is by making your password three random words which are memorable to you, but difficult for others to guess.

2. Turn on two-factor authentication (2FA)

A strong password is a good first step to securing a device and the accounts, but it isn't impossible for cyber criminals to use brute force attacks in an attempt to crack passwords, or to use phishing attacks to dupe users into giving up their passwords.

That's why the NCSC recommends using two-factor authentication to ensure that there's another barrier to attackers gaining access to accounts. Because even if attackers know your password, having to authorise the login attempt via a text message or application on your smartphone makes it harder for hackers to hijack the account.

SEE:A winning strategy for cybersecurity(ZDNet special report) |Download the report as a PDF(TechRepublic)

"While you're at it, turn on 2FA for your main email account if you haven't already. That's the centre of your digital life because things like password resets get sent there, so it needs to be better protected than other accounts," saidIan Levy, technical director at the NCSC.

3. Always accept automatic updates

Smartphones, tablets, computers and Internet of Things devices all now regularly receive updates from manufacturers but users will regularly put off applying either because they see installing the updates as a waste of time or don't understand why devices need to be updated.

However, updates are often issued after security vulnerabilities arise as means of closing loopholes which can otherwise be exploited by hackers. Many of the most high-profile malware campaigns and cyber attacks of recent years have spread so easily because they're taking advantage of known vulnerabilities which users haven't applied the patches to fix.

Because of this, the NCSC recommends that users should configure all their smart devices to install automatic updates and to install updates for phones, tablets and computers as soon as they get the option.

4. If you don't want it anymore, perform a factory reset

Sometimes people decide that a gadget isn't for them, or they decide that they want to trade it in for a newer model. If this is the case, the NCSC suggests that users should perform a factory reset of the device. By returning the device to its original settings like this, users will wipe all of their personal data from it, meaning that that information can't be potentially exploited by whoever uses it next.

5. Here's what to do if something goes wrong

If the worst happens and users think an outsider has control of a device inside their home, the NCSC recommends users perform a factory reset. Meanwhile, if users become aware of an incident reported in the news and think their product is affected, they should visit the manufacturer website for advice.

There's also the option of visiting the Information Commissioner's Office (ICO) website, or the website of the NCSC.

The five tips are simple, but they can do a long way to protecting users against the vast majority of cyber attacks.

"Enjoy your new devices and the cool things they can do. Don't be afraid of new technology and the internet. With some basic prevention, you'll be as safe as houses," Levy said.

READ MORE ON CYBER SECURITY

See the original post here:
New Year, new gadgets? Five ways to keep your new devices safe from hackers, cyber attacks and malware - ZDNet

LAS VEGAS, Jan. 6, 2020 /PRNewswire/ --BlackBerry Limited(NYSE: BB; TSX: BB) today announced it has teamed up with Amazon Web Services, Inc. (AWS) to demonstrate a connected vehicle software platform for in-vehicle applications that combines the safety and security of BlackBerry's QNX real-time operating system with AWS' Internet of Things (IoT) Services in the cloud and in the car. The platform enables automotive manufacturers to securely access data from vehicle sensors, and create software applications and machine-learning models for connected, electric, and autonomous vehicles.

With the AWS-powered BlackBerry platform, automotive OEMs can expedite their vision of continuously and quickly bringing innovative connected vehicle services to market, ranging from cockpit personalization, vehicle acoustic conditioning, vehicle health monitoring, and advanced driver assistance systems (ADAS) features.Car companies can also leverage this platform for their new software-centric electric car and autonomous platforms, enabling essential functions such as continuous EV battery life monitoring and prediction, and managing vehicle sub-systems to holistically control warranty costs, providing important security updates and seamless updates of vehicle software features to delight their customers, and drive monetization of vehicle data while exercising control over data access.

The AWS-powered BlackBerry platform combines the two companies' edge and cloud technologies into a comprehensive edge-to-cloud offering for the global automotive industry. QNX software allows automotive OEMs to develop and run a common software platform across in-vehicle systems such as gateways, TCUs, engine controllers, digital cockpits and emerging domain controllers, while AWS capabilities enable automotive software developers to securely and easily access data from vehicle sensors, build software applications and machine learning (ML) models using vehicle data, and deploy them inside the vehicle to enable in-vehicle inference and actions. The platform will integrate the BlackBerry QNX operating system and over-the-air software update services, with AWS IoT cloud services for secure connectivity and telematics, Amazon SageMaker for developing ML models, and AWS IoT edge services for in-vehicle ML inference.

"By working with AWS, we can provide OEMs with a unique foundational software platform that will allow them to build the next generation connected and autonomous cars of the future," said John Wall, Senior Vice President and Co-Head of BlackBerry Technology Solutions. "By combining our technologies and strengths into one dedicated cloud-based offering, we can ensure automakers have the tools they need to deliver the driving experience consumers want, without sacrificing on the security and reliability they need."

"Our automotive customers are developing exciting new products and services that rely on the power of the cloud, IoT, and AI/ML. We are thrilled to be working with BlackBerry QNX to provide secure connectivity and advanced edge computing capabilities for the next generation of electric and autonomous vehicles," said Bill Vass, Vice President, Technology, Amazon Web Services, Inc.

"Combining the safety and security of QNX with AWS cloud and edge intelligence has the potential to speed the development of Karma's connected car ecosystem," said Lewis Liu, Karma Automotive Vice President, Business Development and Strategy. "It shows how Karma's vehicle platform is being used by technologists as a test-bed to prove new innovation, speed product development and ultimately to provide owners with leading cyber-security resources and predictive maintenance information via the latest artificial intelligence applications. The result is enhanced VVIP treatment for our discerning luxury-customer base, and cutting-edge technology that can lead to new business opportunities for Karma beyond pure automotive retail sales."

BlackBerry's full suite of automotive offerings will be demonstrated at the Consumer Electronics Show (CES) in Las Vegas from January 7-10, 2020, at the Las Vegas Convention Center.Visit BlackBerry at Booth #7515 in the North Hall.

About BlackBerry

BlackBerry (NYSE: BB; TSX: BB) is a trusted security software and services company that provides enterprises and governments with the technology they need to secure the Internet of Things. Based in Waterloo, Ontario, the company is unwavering in its commitment to safety, cybersecurity and data privacy, and leads in key areas such as artificial intelligence, endpoint security and management, encryption and embedded systems. For more information, visit BlackBerry.com and follow @BlackBerry.

BlackBerry and related trademarks, names and logos are the property of BlackBerry Limited and are registered and/or used in the U.S. and countries around the world. All other marks are the property of their respective owners. BlackBerry is not responsible for any third-party products or services.

Media Contacts:BlackBerry (519) 597-7273mediarelations@BlackBerry.com

SOURCE BlackBerry Limited

http://www.blackberry.com

Read more here:
BlackBerry Collaborating with Amazon Web Services to Demonstrate Safe, Secure, and Intelligent Connected Vehicle Software Platform for In-Vehicle...

CES With criticism mounting, Amazon's Ring revealed a web dashboard of privacy controls it hopes will slash the number of horror stories coming from customers.

On Monday, in time for this year's CES in Las Vegas, the home surveillance camera and internet-connected doorbell specialist made a point of unveiling an account control panel it hopes will allow users to better manage the access settings on their devices and keep hackers and other intruders out. The new controls will be available across all products.

"This latest feature will make it easy to view and control privacy and security settings from one dashboard," Ring said of the new feature.

"The Control Center will initially let you see and manage your connected mobile, desktop, and tablet devices, as well as third-party services; it will also enable you to opt out of receiving video requests in areas where local police have joined the Neighbors app."

This comes after Ring found itself under fire on a number of fronts for its privacy policies and security protections. In particular, the close relationship Ring struck with America's plod has worried civil rights groups who believe that the cameras provide officers with excessive levels of surveillance power. In short, Ring encourages folks to share their web-connected cam footage with neighbors and the police, opening up a whole can of worms regarding privacy and consent.

And it doesn't alert owners to multiple logins from across the country or world a tell-tale sign of an account compromise nor limit the rate at which miscreants can attempt to guess account passwords. It does not direct people to use multi-factor authentication, nor does it require strong passwords, and nor does it reject username-password combinations known to be stolen from other websites. It basically fails to prevent netizens from falling foul of brute-force attacks and credential stuffing, and subsequent security device hijackings, by miscreants on the other side of the internet.

Don't expect the dashboard rollout to solve any of these worries. Digital-rights group Fight for the Future was quick to dismiss the CES announcement as "a total joke." The dashboard "amounts to little more than a cosmetic redesign," the campaigners added, and no new protections have been added, we're told.

"Amazon is still putting the responsibility on users to protect these devices, knowing full well that they wont," thundered Fight for the Future deputy director Evan Greer.

"You cant sell a car without seat belts or airbags and then say the driver should have installed them when they get in a crash. Amazon is selling cheap, insecure, internet-connected surveillance cameras and convincing people to put them inside their homes, knowing that they put those people in danger."

And then there's the matter of the lawsuits. In December, a class-action case emerged in the US over a spate of hacks of in-home Ring surveillance cameras. And in California on Friday, a second suit [PDF] was filed complete with harrowing details of what lawyers for the plaintiffs call a "living nightmare" enabled by shoddy Ring security.

Named Plaintiffs Ashley LeMay and Dylan Blakeley recounted a time when a hacker broke into the couple's Ring security camera over the internet, and began playing music over the gizmo to lure their 8-year-old daughter into a bedroom where the miscreant could speak to the child.

"Intrigued by the music, the Blakeleys eight-year-old daughter, A., went to the room she shares with two of her younger sisters to investigate. But the room was empty. As A. wandered the room, looking for the source of the music, the song abruptly stopped, and a mans voice rang out: 'Hello there'," the filing recounts.

"It was a stranger an unknown hacker, who had taken over the Blakeleys account and had the ability to see, hear, and speak to A. inside her own room. In a chilling exchange captured on the devices video recording, the hacker began shouting racial slurs at A. and encouraging her to misbehave."

The lawsuit states that there are a number of glaring flaws in Ring's security, such as allowing multiple logins from different IP addresses, not insisting on two-factor authentication and, even then, only using text messages for multi-factor login codes, leaving people open to SIM-jacking attacks.

It might take a bit more than a dashboard to fix this.

Read the original:
Beset by lawsuits over poor security protections, Ring rolls out 'privacy dashboard' for its creepy surveillance cams, immediately takes heat - The...

Over the holidays, the Russian government said it had completed a multi-day test of a national, internal internet known as RuNet, a bid to show that the country's online infrastructure could survive even if disconnected from the rest of the world. Though Russia claims the initiative relates to cybersecurity, researchers and human rights advocates inside Russia and around the world argue that the test underscores Russia's broader campaign to control and censor access to digital information within its borders.

Whether the Kremlin intends to fully cut Russia off from the global internet remains an open question. But through its support of purpose-built Russian services and its tech sector more generally, Russia has indisputably made significant steps toward going it alone. In early December, President Vladimir Putin signed a law that will take effect this summer requiring all computers, smartphones, and smart TVs sold in Russia to come pre-loaded with apps from Russian developers. The government is also investing 2 billion rublesabout $32 millionin a Russian Wikipedia alternative.

Those initiatives, together with increasingly isolationist infrastructure, points to a desire for markedly increased control. But analysts say that last week's test may actually reflect a gradual approach rather than a rush to separate.

"There is not that much data available, but presenting the drills that happened in late December as a real-world exercise about disconnecting Russia from the global internet is probably exaggeration. There were no user reports confirming that," says Leonid Evdokimov, a Russian security researcher at Censored Planet who formerly worked for the Tor Project and the Russian web services giant Yandex. "But the internet censorship and overall situation in Russia clearly has a chilling effect. So it seems there is no urgent need for the government to make an isolated internet right now. The current partial censorship and set of laws produce enough of a noticeable effect."

The fear is that at some point the government will trade incremental infringement for radical repression.

Over the last decade, the Russian government has worked steadily to build out legal and infrastructure-level internet controls, establishing content filters and block lists and introducing oversight mechanisms within private telecoms. In October 2018, the Russian government cut mobile data service in the Ingushetia region during political proteststhe first such internet outage in the country. Last August, the government initiated another internet blackout, this time during protests in Moscow. And in November, a new "sovereign internet" law also took effect, legalizing more radical isolation, including last week's test.

Technical challenges have slowed Russia's efforts, though. In the case of China, whose so-called Great Firewall gives the government near-absolute control over the internet, censorship and blocking infrastructure was built in from the start. In a country like Russia, where the internet grew mostly unchecked for decades, it's tougher to retrofit mechanisms for control. Take Russia's efforts in 2018 to ban the encrypted messaging app Telegram, which largely failed as Telegram and its users deployed anti-censorship techniques. Similarly, Russia's efforts to crack down on VPNs have been very problematic, but still not comprehensive.

"I dont think were going to see a large-scale shutdown in Russia or a large-scale block of big digital platforms. It isnt strategically viable," says Allie Funk, a research analyst at the pro-democracy group Freedom House, who works on an annual Freedom on the Net global assessment. "Russian users as a whole are extremely politically active and the government doesn't really want to deter foreign tech companies. So it seems like what they're trying to do is create an environment in which international or foreign platforms are more willing to comply with Russian laws."

That isn't to say the government couldn't eventually develop comprehensive control, but it hasn't yet demonstrated anything close to a full connectivity blackout or internet separation. In contrast, the Iranian government caused a total country-wide blackout in November that lasted multiple days. Iran is a much smaller and more geographically contained country than Russia, though.

Read the rest here:
Russia Takes a Big Step Toward Internet Isolation - WIRED