Mornings With Mark

Two major security issues with popular smartphones this week. First the Samsung Galaxy S10 and then the Google Pixel 4. For the Galaxy, it's fingerprint reader currently accepts any fingerprint to unlock the device and authorized activities. While the Pixel does not require attention for facial recognition to unlock the device or authorize activities.Neither is good. Though the response is telling. Samsung is quickly pushing out a patch to resolve their issue. Google has issued a statement say that facial recognition is working as expected and in the future, it may add extra features like attention detection.Getting users to accept new security controls is an uphill battle, any setback makes it harder for any solution to push out additional security measures. But the response is a stark reminder that security features are just like any others. They will be triaged for bugs and prioritized according to criticality and demand. And sometimes, other pressures mean that the security-focused call isn't the one that's made.References:Reuters on the Samsung Galaxy S10 issue, https://www.reuters.com/article/us-samsung-elec-smartphone/samsung-to-patch-galaxy-s10-fingerprint-problem-idUSKBN1WW0Q5BBC News has the report on the Google Pixel 4, https://www.bbc.com/news/technology-50085630MY AWS re:Invent 2019 series, https://markn.ca/2019/aws-reinvent/ 

In the 200th episode of the show, we look at e-transfer security. Sending money via email is simple and efficient, but is it safe?Turns out, not so much. Both from a practical standpoint and a legal one.References:- CBC's Go Public on the latest victim, https://www.cbc.ca/news/business/etransfer-fraud-banks-blame-customers-1.5286926- Erica Johnson from CBC News on the rising frequency of e-transfer fraud, https://www.cbc.ca/news/business/rbc-customer-out-of-pocket-after-e-transfer-fraud-1.5128114- Interac e-transfer terms and conditions, https://www.interac.ca/en/interac-e-transfer-terms-of-use.html

CBC News posted an article about how Canadian federal MPs are using digital tracking technologies on their personal websites The article was fair and covered the technology and some of the potential issues, however this is just standard digital adtech. Does that make it right? No, but it's not a scandal in of itself. So what is retargeting? How is it used? Why is its use in politics different? References;- article by Elizabeth Thompson and Andrea Bellemar for CBC, https://www.cbc.ca/news/politics/election-advertising-web-trackers-1.5276287- Hubspot's beginner guide to implementing retargeting, https://blog.hubspot.com/marketing/retargeting-campaigns-beginner-guide- CBC News on the Canadian 2019 federal election announcement, https://www.cbc.ca/news/politics/election-campaign-starts-today-1.5277657

Letting customers know about a security vulnerability is never an easy thing. From the logistics of it to the reputation management issues. But this is a critical aspect of delivery software and services. Recently MuleSoft handled a disclosure in a truly impressive way. They reached out via email and then called customers to let them know about the issue. This not only helps get the word out but also provides much needed context for the patch that is typically lacking. References: Catalin Cimpanu for ZDNet on the issue, https://www.zdnet.com/article/how-mulesoft-patched-a-critical-security-flaw-and-avoided-a-disaster/

Cybercriminals don't always use complicated technical attacks to get around your cybersecurity. Sometimes—probably more often than we care to admit—it's the really simple stuff that works and what's simpler than an email? Business email compromise is a social engineer technique that raked in over a $1B in the US alone last year. In this scam, the criminals leverage fake business pressures to circumvent normal financial processes. It's simple and it works. References; a business in North Battleford, Saskatchewan lost $1.4 M in this type of scam, https://www.cbc.ca/news/canada/saskatoon/spence-equipment-fraud-sask-1.5256322 the Ontario Provincial Police warn of an increase in "CEO email scams" province wide, https://ottawacitizen.com/news/local-news/police-warn-of-ceo-email-scams#click=https://t.co/OYhpIrCS33 financial reporting on the scam in the US, https://www.cyberscoop.com/business-email-compromise-bec-fincen-report-2019/ basic attack facts from Trend Micro, https://www.trendmicro.com/vinfo/us/security/definition/business-email-compromise-(bec)