New research from SailPoint, the identity governance platform, highlights how despite the prevalence of data breaches, the way employees approach security is getting worse as the supposed ‘technologically savvy’ millennials enter the workforce. Of the 1,600 global employees surveyed, 75% of respondents admitted to reusing passwords across accounts, including work and personal, compared to 56% who admitted to doing so in 2014. Nearly 90% of 18–25 year olds break the most basic of security rules, reusing passwords across different accounts According to the study, this is likely down to organisation’s digital transformation efforts, as the evolution has brought with it an increasingly complex IT environment. This has introduced both more risk and a sense of frustration between the IT team trying to secure and enable the business and users who want to work more efficiently. Over half (55%) of survey respondents stated their IT department can be a source of inconvenience in their organisation. This leads to employees skirting IT policies, such as the 31% who admitted that they have deployed software without IT’s help.
Juliette Rizkallah, CMO, SailPoint, said: “To secure and enable today’s modern workforce, the users have become the new ‘security perimeter’, and their digital identities are the common link across an organisation’s IT ecosystem at every stage of its digital transformation. “By taking an identity-centric approach to security, IT can gain full visibility and control into which applications and data that users, including both human and non-human bots, are accessing to do their jobs. This approach allows enterprises of all sizes to confidently address the tension between enablement and security exposed in our Market Pulse Survey.” The research is based on the interviews with 1,600 employees at organisations with at least 1,000 employees across Australia, France, Germany, Italy, Spain, the United Kingdom and the United States.
A location-tracking smartwatch worn by thousands of children has proven relatively easy to hack. A security researcher found the devices neither encrypted the data they used nor secured each child's account. As a result, he said, he could track children's movements, surreptitiously listen in to their activities and make spoof calls to the watches that appeared to be from parents. Experts say the issues are so severe that the product should be discarded. Both the BBC and the researcher involved tried to contact the makers of the MiSafes Kid's Watcher Plus to alert them to the problem but received no reply. Likewise, a China-based company listed as the product's supplier did not respond to requests.
The MiSafes watch was first released in 2015. It uses a global positioning system (GPS) sensor and a 2G mobile data connection to let parents see where their child is, via a smartphone app. In addition, parents can create a "safe zone" and receive an alert if the child leaves the area. The adult can also listen in to what their offspring is doing at any time and trigger two-way calls. Pen Test Partner's Ken Munro and Alan Monie learned of the product's existence when a friend bought one for his son earlier this year. Out of curiosity, they probed its security measures and found that easy-to-find PC software could be used to mimic the app's communications.
This software could be used to change the assigned ID number, which was all it took to get access to others' accounts, making it possible to see personal information used to register the product, including:
Rather than compromise other people's watches, the researchers bought several more units to test. With these, they found it was possible to:
Using a different tool, Mr Munro said his team were able to see that about 14,000 MiSafes were still in active use
The Norwegian Consumer Council highlighted other cases of child-targeted smartwatches with security flaws last year. It said the MiSafes products appeared to be "even more problematic" than the examples it had flagged. "This is another example of unsecure products that should never have reached the market," said Gro Mette Moen, the watchdog's acting director of digital services. "Our advice is to refrain from buying these smartwatches until the sellers can prove that their features and security standards are satisfactory." In the UK, Amazon used to sell the watches but has not had stock for some time. The BBC found three listings for the watches on eBay but the online marketplace said it had since removed them on the grounds of an existing ban on equipment that could be used to spy on people's activities without their knowledge.
MiSafes previously made headlines in February when an Austrian cyber-security company discovered several flaws with its Mi-Cam baby monitors. SEC Consult said these meant hackers could spy on footage from owners' homes and hijack accounts.
https://www.cybersecurityintelligence.com/
Juliette Rizkallah, CMO, SailPoint, said: “To secure and enable today’s modern workforce, the users have become the new ‘security perimeter’, and their digital identities are the common link across an organisation’s IT ecosystem at every stage of its digital transformation. “By taking an identity-centric approach to security, IT can gain full visibility and control into which applications and data that users, including both human and non-human bots, are accessing to do their jobs. This approach allows enterprises of all sizes to confidently address the tension between enablement and security exposed in our Market Pulse Survey.” The research is based on the interviews with 1,600 employees at organisations with at least 1,000 employees across Australia, France, Germany, Italy, Spain, the United Kingdom and the United States.
A location-tracking smartwatch worn by thousands of children has proven relatively easy to hack. A security researcher found the devices neither encrypted the data they used nor secured each child's account. As a result, he said, he could track children's movements, surreptitiously listen in to their activities and make spoof calls to the watches that appeared to be from parents. Experts say the issues are so severe that the product should be discarded. Both the BBC and the researcher involved tried to contact the makers of the MiSafes Kid's Watcher Plus to alert them to the problem but received no reply. Likewise, a China-based company listed as the product's supplier did not respond to requests.
The MiSafes watch was first released in 2015. It uses a global positioning system (GPS) sensor and a 2G mobile data connection to let parents see where their child is, via a smartphone app. In addition, parents can create a "safe zone" and receive an alert if the child leaves the area. The adult can also listen in to what their offspring is doing at any time and trigger two-way calls. Pen Test Partner's Ken Munro and Alan Monie learned of the product's existence when a friend bought one for his son earlier this year. Out of curiosity, they probed its security measures and found that easy-to-find PC software could be used to mimic the app's communications.
This software could be used to change the assigned ID number, which was all it took to get access to others' accounts, making it possible to see personal information used to register the product, including:
- a photo of the child
- their name, gender and date of birth
- their height and weight
- the parents' phone numbers
- the phone number assigned to the watch's Sim card
Rather than compromise other people's watches, the researchers bought several more units to test. With these, they found it was possible to:
- trigger the remote listening facility of someone else's watch, with the only warning being that a brief "busy" message appeared before its screen returned to blank
- track the wearer's current and past locations
- alter the safe zone facility so that alerts were triggered by a child's approach rather than their departure
- Pen Test Partners also learned it was possible to bypass a feature supposed to limit the watch to accepting calls from only authorised parties. The researchers did this by using an online "prank call" service that fools receiving devices into showing another person's caller ID number.
Using a different tool, Mr Munro said his team were able to see that about 14,000 MiSafes were still in active use
The Norwegian Consumer Council highlighted other cases of child-targeted smartwatches with security flaws last year. It said the MiSafes products appeared to be "even more problematic" than the examples it had flagged. "This is another example of unsecure products that should never have reached the market," said Gro Mette Moen, the watchdog's acting director of digital services. "Our advice is to refrain from buying these smartwatches until the sellers can prove that their features and security standards are satisfactory." In the UK, Amazon used to sell the watches but has not had stock for some time. The BBC found three listings for the watches on eBay but the online marketplace said it had since removed them on the grounds of an existing ban on equipment that could be used to spy on people's activities without their knowledge.
MiSafes previously made headlines in February when an Austrian cyber-security company discovered several flaws with its Mi-Cam baby monitors. SEC Consult said these meant hackers could spy on footage from owners' homes and hijack accounts.
https://www.cybersecurityintelligence.com/
No comments :
Post a Comment