 A hot potato: Intel's largely undocumented master controller for its CPUs has a vulnerability that cannot be fixed, and is so severe that it can allow malicious actors to bypass storage encryption, copyrighted content protections, and take control of hardware sensors in IoT devices. Security researchers have discovered that a new vulnerability present in Intel chips that have been released over the last five years is unfixable outside of replacing the hardware that's currently being used in millions of commercial and enterprise systems. Specifically, this has to do with the Converged Security and Management Engine, which is essentially a tiny computer within your computer that has full access to all data that flows through your PC, from internal components to peripherals. Intel has guarded the secrets of how this engine works in an effort to prevent competitors from copying it, but that hasn't prevented security experts from trying to crack their way in to see if it can be exploited by malicious actors. The unfixable flaw was discovered by Positive Technologies, who says it's a firmware error that's hard-coded in the Mask ROM of Intel CPUs and chipsets. The problem is that Intel's CSME is also responsible for several security features, including the cryptographic protections for Secure Boot, digital rights management, and Enhanced Privacy ID (EPID). It also houses the Trusted Platform Module (TPM) that allows the OS and apps to store and manage keys for things like file system encryption. Researchers explained that hackers can exploit a firmware error in the hardware key generation mechanism that allows them to take control of code execution. They noted that "when this happens, utter chaos will reign. Hardware IDs will be forged, digital content will be extracted, and data from encrypted hard disks will be decrypted."The only recent platform immune to the problem is Intel's 10th generation, Ice Point chipsets and SoCs. However, the good news is that the attack method described by Positive Technology is rather difficult to achieve without other factors at play, such as direct physical access to the hardware in question. This isn't the first time someone has managed to crack open Intel's ME subsystem. Security researchers uncovered other vulnerabilities in Intel's hardware in 2017 and 2018, not to mention the Spectre-style one from 2019 and the recently disclosed CacheOut attack, but at least those are fixable. Stay on top of the by visiting OUR FORUM.  The California Consumer Privacy Act (CCPA) is a state-wide data privacy law that regulates how businesses all over the world are allowed to handle the personal information (PI) of California residents. The effective date of the CCPA is January 1, 2020. It is the first law of its kind in the United States. CCPA applies to any for-profit businesses in the world that sells the personal information of more than 50,000 California residents annually, or have annual gross revenue exceeding $25 million, or derives more than 50 percent of its annual revenue from selling the personal information of California residents. Sale of PI is defined in the CCPA as “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to another business or a third party for monetary or other valuable consideration.” (1798.140.t1). If a company shares common branding (i.e. shared name, service mark or trademark) with another business that is liable under the CCPA, the company will be subject to CCPA compliance too. Under the CCPA, California residents (“consumers”) are empowered with the right to opt-out of having their data sold to third parties, the right to request disclosure of data already collected, and the right to request deletion of data collected. Additionally, California residents have the right to be notified and the right to equal services and price (i.e. cannot be discriminated against based on their choice to exercise their rights). Failure to comply with the CCPA can result in fines for businesses of $7,500 per violation and $750 per affected user in civil damages for businesses. The power to enforce the CCPA lies with the office of the Attorney General of California, who has until July 2020 to specify enforcement regulation. However, the interim period between January and July 2020 is not a grace period, and businesses are liable for civil lawsuits from their data collection and selling from January 1, 2020. If your business meets any of the three CCPA thresholds above and has an online domain, you are required to implement certain changes to your website. Your website must inform its users at or before the point of data collection about the categories of personal information that it collects and for what purposes. Your website must feature a Do Not Sell My Personal Information link that users can use to opt-out of third-party data sales. If your website has minors under the age of 16 among its users, you are required to obtain their opt-in (consent) before you are allowed to sell or disclose their personal information to third parties. If the minor is under the age of 13, a parent or legal guardian must opt-in for them. Your business must also update its website’s privacy policy to include a description of the consumer’s rights and how to exercise these rights. Your privacy policy must also contain an annually updated list of the categories of personal information that your company collects, sells and discloses. Complete details, plus the Full Text of CCPA can be found on OUR FORUM. The smartphone in our pockets has become our dirty secret. The next time you grab a friend's smartphone to stare at a picture or to watch the video on YouTube they simply had to share, you might want to think again. Or, even better, take a look at your own mobile device and wonder: when did I last clean it? On January 17, ZDNet took to Twitter to ask a simple question: How often do you disinfect your phone? The results surprised us and certainly revealed a disturbing truth: the majority of us are filthy creatures. In total, 18.5% of you said your smartphone was subject to a weekly clean, whereas 14% said their mobile device was subject to a monthly spruce-up. A whopping 60% of you admitted you never cleaned your mobile device. 7.4% inferred you would clean it after you've been sick. Our readers aren't alone, either, in grim habits: a 2019 report (.PDF) of 1,200 US residents and their hygiene practices found that 88% of adults use their phones in the bathroom. If you're a parent, you are even more likely to do so with the figure climbing to 93%; perhaps in a bid to snatch a few minutes of peace to check social media feeds and emails. (All in all, there are probably only two types of smartphone users: those who admit to using their device in the bathroom, and those who lie about it.) Your smartphone goes everywhere with you. The lounge, the bathroom, the kitchen, the bedroom, the pub. You touch the screen after you've washed up with the germ-infested kitchen sponge that really should have been thrown away days ago. You refill the dog bowl, perhaps receive an affectionate lick in gratitude and then accept a call, thereby pressing the screen to your face. You unlock your phone in the pub garden to check a notification after you've used the restroom. (You've washed your hands but how many reprobates have you seen while you're in there bypass the sink entirely to grab the door handle on their way out?) It's no wonder that smartphones are now comparable to toilet seats when it comes to the germs and viruses that claim them as home. Other recent studies confirm high colony-forming units (CFU) per square inch levels on our mobile devices. If you're like me and travel often with a smartphone glued to your hip, you really might want to take a wipe with you. Outstripping everything else on the list, a study into airport self-check-in kiosks showed they contain a massive 253,857 CFU per square inch, thanks to our grubby hands. We can't get rid of our smartphones, despite the breeding grounds of germs they have become, and it's important we don't sterilize our lives to the point we hamper our own immune systems. But it might be about time we think about cleaning our devices a little more often, especially in the winter season when cold and flu bugs are rampant and when touch can be enough to transfer contagious illnesses to our nearest and dearest. The now global challenge posed by the coronavirus is an additional wake-up call. Learn the proper way to clean your phone by visiting OUR FORUM. |
Latest Articles
|