fbpx
Connect with us

Cybersecurity

A law issued in 1789 may put your iPhone at risk

Published

 on

A law issued in 1789 may put your iPhone at risk

“We have even put that data out of our own reach- because we believe the contents of your iPhone are none of our business,” said Apple in a statement released in 2016. The company, that has been refusing orders from the Federal Bureau of Investigation (FBI) to unlock devices seems to be in a pickle.

In 2019, the FBI started investigating the case of Mohammed Saeed Alshamrani, a military trainee who killed three US sailors and wounded several others in a terror attack on a military base in Pensacola, Florida. Back then, Apple refused to break into his iPhone and claimed that the company provided every piece of information available to it, including iCloud backup, account information, and transactional data for multiple accounts.

On May 18, 2020, Attorney General William Barr and FBI director Christopher Wray had a press conference after they successfully broke into the iPhone – with no thanks to Apple according to Barr. FBI finds out that the gunman ties with Al Qaeda in the Arabian Peninsula (AQAP) began in 2015. Barr said that Apple’s decision has dangerous consequences for public safety and national security. “We are confident that technology companies are capable of building secure products that protect user information and at the same time, allow for law enforcement access when permitted by a judge,” he said. On the same day, Apple issued a statement saying that “There is no such thing as a backdoor just for the good guys, the American people do not have to choose between weakening encryption and effective investigations.”

In May 2020, Digital Trends requested a comment from Apple on the incidence as to whether this would force the company to rethink its encryption, or whether the average iPhone user should be concerned. But there was no response from the company.

In 2016, the FBI was investigating the case of Syed Rizwan Farook, the gunman of the San Bernardino, Calif., mass shooting. Farook is killed and the FBI has a warrant to access information on his phone but they can’t ask him for this unique decryption key and Apple doesn’t have it either. In March 2016, the FBI was able to crack his iPhone 5C running Apple’s iOS 9 mobile operating system.

There was no other way for the FBI to unlock the iPhone but to guess the code. However, Apple designed a security system that can wipe a phone’s data following too many incorrect guesses. The FBI asked Apple to write a workaround that turns this feature off. Apple refused. But the FBI found a way to hack the iPhone. “Apple has attempted to design and market its products to allow technology, rather than the law, to control access to data which has been found by this Court to be warranted for an important investigation,” the US attorneys said.

Federal officials refused to identify the person/organization that helped them crack the phone. This came as no surprise. According to The New York Times, Stewart A. Baker, a lawyer at Steptoe & Johnson and the Department of Homeland Security’s first assistant secretary for the  police said: “The method used is proprietary to the company that helped the FBI so it’s possible that the government won’t reveal the method that allowed them to crack the iPhone”.

Apple engineers have also begun developing new security measures that will make it impossible for the government to open an iPhone. Experts said that the government might have used different methods in order to unlock the iPhone. One of these methods is removing a chip and fooling it. This mechanism blocks password guessing, in order to find the user’s password and unlock the data. Another mechanism used by the government might be the NAND chip. This method could allow the FBI to replace the original NAND chip by another one that has a copy of the content. This procedure mirror’s the phone storage chip and copies it onto another chip.

What is really interesting is that a new iPhone has upgraded a chip known as the A7 with Secure Enclave, a security processor that has a unique numerical key which is essential to the security of information stored on the phone. This numerical key is not known to the company. Thus, new iPhones may be less susceptible to NAND-mirroring. But how was the FBI able to unlock Alshamarani’s iPhone?

In fact, the Silicon Valley company was ordered by a federal magistrate judge in California to help unlock the smartphone. Timothy D. Cook, Apple chief-executive opposed to the order via a public letter he published on February 16, 2016. “The United States government has demanded that Apple take an unprecedented step which threatens the security of our customers,” he said.

Cook avowed that this order has implications far beyond the legal case at hand. “The US government is asking us to create a new version of IOS that bypasses security,” he said. This software does not exist today and if so, it would have the potential to unlock any iPhone in someone’s physical possession. The US government suggested that this tool can be used on one iPhone. But according to Cook, once created, this technique can be used to crack other iPhones.

What is more important, privacy or security? This is the FBI-Apple debate that would define the future of digital privacy.

In fact, the US government invoked the All Writs Act (AWA) signed by President Georges Washington in 1789. Courts have tended to use this law when there are extraordinary circumstances- which applies to cases such as Farook and Alshamrani. Under this law, federal judges have the power to issue orders to compel people to do things within the limits of the law.

The Communications Assistance for Law Enforcement Act (CALEA) already limits the ability of law enforcement agents to dictate design and software configurations. According to the Center for Internet and Society at Stanford Law School, CALEA applies to the manufacturer- Apple is the case- and providers of telecommunications services.  According to the Legal Information Institute at Cornell Law School, CALEA permits the strongest encryption deployed by a manufacturer under the section 1002 (b) (3): “A telecommunications carrier shall not be responsible for decrypting, or ensuring the government’s ability to decrypt, any communication encrypted by a subscriber or customer- unless the encryption was provided by the carrier and the carrier possesses the information necessary to decrypt the communication”. In fact, this act limits court orders written under the AWA.

Neil Richards, professor of law and a privacy law expert at Washington University in St. Louis pointed out that intermediaries’- Apple for example- decisions on our behalf directly affect our civil liberties, including our right to privacy. “Law enforcement demands would be unconstitutional in the physical world and few companies are courageously standing up for the rights of their users,” he said for “The Source”.

It’s completely understandable that the FBI is seeking criminals to Justice. But this might put the user’s privacy at risk. In fact, privacy is secured under the International Human Rights law as well as the EU’s General Data Protection Regulation (GDPR). Undoubtedly, the Apple and FBI dispute is opening a new debate on digital rights.

Ranine joined Inside Telecom as an Investigative Journalist. Her extensive fieldwork and investigations shed light on many socio-economic issues. Over the past few years, she has transformed her key findings into in-depth analytical reports. She earned a Bachelor’s Degree in Journalism and Communication.

Cybersecurity

Password Management in Network Security

Published

 on

Password Management in Network Security

When it comes to ensuring the highest levels of cybersecurity for any establishment, password management in network security is one of the most paramount factors in guaranteeing security. As one of the essential cybersecurity measures, password management is a critical element for any online activity, whether for software or hardware. Everything is protected with a password.

What is Password Manager and How does it Work?

To those not familiar with the concept, password management’s significance exceeds the creation of a strong password to protect your data or account. It is a cybersecurity system. A system that manages any saved login credentials, all while guaranteeing a safeguarded relocation of data from one device to another. When coming up with a valid password, a few factors must be taken into account, such as the potential of being exposed to high risks and identity theft.

For any establishment, the correct password manager helps to monitor any activity and amounts of logins for servers people work on. As a software application, it is developed for storing and managing online credentials. With the increased available platforms and programs requiring safety credentials, the risk of losing or forgetting a password has never been higher. User password management, such as Google password manager, helps users with a handful of passwords for essential web applications.

By providing the needed digital space to generate and store any, and all passwords in one location, password management in network security keeps any data safe and secure in various ways, including biometrics data.

Why Use Password Manager?

Through the encryption of users’ logins, a reliable password manager protects your credentials and cannot be accessed until the master password is submitted. In this case, no password is stored on the device itself or even on the manager’s servers. While some might think that storing all of your important passwords in one place might be hazardous, the truth is, password managers are the safest bet to safeguard all your passwords, as the chances of a password manager being breached are extremely low and almost very unlikely to happen.

Without getting into all the technical terms as to why password managers are the safest option, these applications can be perceived as the lesser evil. While users will still need to create one master password – preferably to be long and a bit complicated – it will guarantee the protection of any login credential for any account or credit card information.

The ideal password managers to download are backed by two-factor authenticators, where users are asked for a one-time code alongside the password whenever a new login into a new device takes place.

Password Management Best Practices in Network Security

In terms of obtaining the highest level of protection for network security, few practices are applicable to almost anyone to ensure the highest level of user password management.

1. Training

Training the team and raising awareness of potential password threats is one of the most important things to consider. Team members working on network security have to understand the risk of cybersecurity and the importance of implementing the right measure to protect and secure any account credential.

2. Enforcement of Reliable and Strong Passwords

Enforcing the creation of strong passwords and establishing they follow the best practices for network security to protect the network and its data while respecting the integrity, confidentiality, and accessibility of the network’s computer systems.

This includes performing a thorough network audit, deploying network and security devices, disabling file sharing features, updating antivirus and anti-malware software, securing all routers, using a private IP address, and finally establishing a network security maintenance system.

3. Multi-factor Authentication

Endorsing your password management with two-factor authentication is like adding another solid layer of protection to your accounts and their passwords. Multi-factor authentication ensures that only people responsible for the network have access to its sensitive data.


Inside Telecom provides you with an extensive list of content covering all aspects of the tech industry. Keep an eye on our Cybersecurity space to stay informed and up-to-date with our daily articles.

Continue Reading

Cybersecurity

How to Check a Suspicious Link Without Opening it

Published

 on

We are all well aware of the troubles opening a fishy link can lead us to.  Luring users to click on a given link has been of one the well-known techniques to get access to the device, install virus and malware or even go as far as creating a full ransomware attack. To protect your computer and private information, there are multiple techniques to check links without opening them. What is important though is never to open the link if it is suspicious.

When you are not dealing with a shortened URL, the best way to go thoroughly through the link to see if there is any spelling mistake. Attackers usually tend to change a minimum number of letters so that you are unable to tell the difference. For instance, things like www.goagle.com instead of www.google.com should catch your attention with the second ‘o’ of Google replaced with an ‘a’.

Emails are the best sources for phishing attacks. These kinds of attacks are used to steal some sensitive information such as passwords and credit card information. The best way to avoid these kinds of attacks is to authenticate the sender. For that purpose, do not only check the name of the sender, you need to double-check the email the sender is using. In general, attackers use credible sender names with emails which do not correspond to the promoted identity. Next time you get an email from your bank like “XBank”, check that the sender email is person@Xbank.com rather than person@anyothermailclient.com.

Many websites actually provide link checking or link scanning features. This is a very neat technique to simple check the link before clicking on it.

VirusTotal

www.virustotal.com  is an excellent website for this task. This online tool practically does the job of an anti-virus. When you go to the website, you have the possibility to analyze files and URL for malware or any other security breach. Once you submit your file or enter the URL, the website will use different tools and software, then provide you with a detailed output from each of these tools. If you are unsure if a given software is credible enough, you can compare it to the output of other platforms on a single website.

Use a Short URL Expander

Sometimes attackers try to shorten URLs to hide any malicious intention. Analyzing shortened URL is not straightforward. To overcome this problem, copy the provided URL without opening it and use specific websites that actually expand the provided URLs. Then, you can analyze the original URL for possible security breaches.  Many websites are there to do this task. Just search for “short URL expander” on your search engine and use the top provided websites.

Upgrade your Anti-Virus with Internet Security Features

Anti-virus software is commonly used to protect personal computers from viruses and other malware. While these are available for free, you can easily upgrade them to include internet security features for a small monthly fee. This will bring major improvement to your internet browsing experience including custom-made safe browsing tools.

Use Google Transparency Report

Google provide a nice tool to check for the safety of websites. To do so, visit https://transparencyreport.google.com and enter the URL in question. The Google source will then provide you with a safety report of that website.  

The nicest solution is kept to the end. When you hover over a link in your email client or web browser, a small square appears including all the information related to the chosen URL. These details can be used to give a preliminary indication whether to trust the source.

Final Thoughts

Suspicious links are everywhere! To make sure they don’t catch you by surprise, follow the highlighted and you’ll be safe to go.


“Inside Telecom provides you with an extensive list of content covering all aspects of the tech industry. Keep an eye on our Cybersecurity space to stay informed and up-to-date with our daily articles.”

Continue Reading

Cybersecurity

Disadvantages of AI in Cybersecurity

Published

 on

Cybersecurity and artificial intelligence (AI) are two very trending topics at the moment. AI has been the pivotal elements modifying business strategies, improving decision-making processes, and triggering automation in every industry in the world. The latest sentience debate is a clear indicator on serious and advanced AI is becoming nowadays. Cybersecurity is the other important element of today’s technological world. With an increasing reliance on data and the move to online services that require an individual’s biometrics, security essential in preventing data thefts and associated cybercrimes. AI has undeniably improved cybersecurity practices by allowing a real-time analysis of internet traffic to discover possible threats at the earliest and take defensive actions. This important learning process hides however several disadvantages of AI in cybersecurity.

What Are the Downsides to AI in Cybersecurity?

The touted advantages of AI in cybersecurity are real and very useful. However, the increasing adoption of AI solutions for security is actually causing problems at different levels.

Hackers Use AI as Well

When it comes to maturity in technology, hackers are the best at it. These individuals sitting behind computer screens logging data and doing advanced analytics to identify any loophole or vulnerability they can use to their benefits. The use of AI as far as cybersecurity is concerned is a double-edged sword. It is actually a race of who can develop a better algorithm that caters better to the data which is circulating online. In this sense, the use of AI is a big threat to security.

Another issue is that while a company is analyzing and learning from data to discover threats, a hacker is concurrently analyzing the company’s cyber-defense mechanisms and policies to find “open doors’ that will take it into the system to complete the intended attack.

Data Confidentiality

AI algorithms are associated with the analysis with large volumes of data, a key requirement for the developed algorithms to produce accurate outputs. The data a company deals with contains normal traffic related to daily transactions and activities, but also sensitive information related to the clients including their biometrics and personal information. What happens to our data when it goes to the AI-agent though is another thing. Protecting the data is key when AI is used for cybersecurity reasons. The secrecy of the clients’ data should not be compromised for any reason.

Increasing Need for Data

The field of cybersecurity is constantly evolving with ingenious attacks and threats emerging every now and then. Browser-in-the-browser attacks and increasingly advanced ransomware attacks have been notable examples in 2022. In order to discover attacks at a later stage, the AI algorithm needs to have data to do the proper training. The increasingly dynamic environment with threats emerging and evolving will lead to a surge in the required volumes of data, which can potentially not be readily available to have a fast response to the attack itself. Whether it is the ability of AI to keep track of the exponential growth in data or the availability of data for the AI-algorithm to produce results is a big disadvantage of this approach for cybersecurity

Will Cybersecurity be Replaced by AI?

With the drive towards more and more automation, it is questionable whether this can be applied as well for cybersecurity practices. AI can certainly assist in processing and learning from data and produce insights. However, the real decision maker in such as sensitive area where no errors can be tolerated is the cybersecurity expert himself. The only way for AI to replace cybersecurity is when it becomes sentient or developed enough to think and act like humans do. There is still a long way for that to concretize.

Explainable or interpretable AI is a key intermediate step in reaching this target. First, we need to understand how AI produces results. Proper cybersecurity practices require a reduction in bias while optimizing the performance of the algorithm.

How Will AI Affect Cybersecurity Jobs?

The adoption of AI will certainly cause major shifts in the cybersecurity job market as in the case in other industries, but probably at a smaller scale. The level of skill and experience needed to thwart cyberattacks will safeguard the need for security experts to provide the final decision regarding suspicious data patterns.

On the other hand, the incorporation of AI will call for new skilled workers that can manage and optimize the performance of the algorithms. Another alternative would be for existing workforce to be upskilled and retrained to handle the new analysis tools.

Summary

As data is becoming the basic unit for decision making, AI has invaded all industries and businesses, including cybersecurity. Companies are starting to incorporate learning algorithms to their offered services in order to have a more intelligent management of the different security threats. However, the role of AI in cybersecurity should be considered with enough judgment. The addition of AI would increase the complexity in the data management process, notably in terms of data privacy and the continuous need for more data.


“Inside Telecom provides you with an extensive list of content covering all aspects of the tech industry. Keep an eye on our Cybersecurity and Artificial Intelligence space to stay informed and up-to-date with our daily articles.”

Continue Reading

Trending