Android Gets 'Dns Over Tls' To Encrypt Dns Requests

Android gets a feature that causes dns requests to be encrypted so that ISPs do not see which websites their subscribers seek, so XDA reports. Dns (domain name system) is similar to the phonebook and, among other things, translates domain names into IP addresses.

If an Internet user enters a domain name in his browser, the computer sends a request to a dns server, which then returns the website's ip address to the browser, which can load the website. Often these requests go to the internet server's dns server. However, the requests are unencrypted, allowing anyone who has access to the connection that can see.

Dns over tls is a protocol that encrypts dns requests, as does https for traffic to and from websites. The encryption of tls must prevent tapping and manipulating dns requests in the network, thus protecting the privacy of users. Inside the Android Open Source Project (AOSP), code has now appeared that indicates that dns is added to tls on Android.

Users could immediately enable or disable it using the OS's Developer Options. The feature may be added to Android 8.1. Users who want to use dns over tls must choose a dns server that supports this. In addition, the encrypted dns requests will still be visible to this dns server.

Gmail Notifies Users Of Unencrypted Messages

Google Gmail users will now warn if they receive unencrypted messages, as the Internet giant has on Safer Internet Day 2016 announced . Google itself uses TLS encryption for encrypting messages. Gmail users can send encrypted messages to each other in this way. TLS is not yet used by all email providers.

This allows messages that Gmail users received via this e-mail providers, or send to this, be read. Gmail will therefore present a warning showing that the email provider of the addressee no encryption support, or if a message is received that is not encrypted via TLS. There will also be a warning if the sender's domain could not be authenticated. Gmail recently did not know that more and more support major email providers tls and domain authentication.

From investigation of Google, the University of Michigan and the University of Illinois show that from December 2013 to October 2015 the number of encrypted emails rose Gmail non-Gmail users received from 33% to 61%. In the same period, the number of emails were encrypted using TLS and Gmail to non-Gmail users was sent from 60% to 80%. Further uses 94% of the incoming email for Gmail, a form of authentication to protect against phishing and spoofing.

John Rae-Grant Google argues that not all e-mails which warned is dangerous. "But we advise you to be extra careful when answering or opening links in messages that you have doubts about. And by this update, you have the resources to make that decision."

Firefox Will Warn Login Via HTTP

Mozilla Firefox 44 will warn users when they attempt to log in to a website that sends the password over HTTP. In this case, the open source browser will display a warning stating that the connection is not secure and the credentials can be stolen.

That Richard Barnes from Mozilla via Twitter announced. The measure is now in an early version of Firefox 44 for testing. In case a website login via HTTP sends the browser's address bar will show a red line through a lock. The warning also appears in login forms that are offered via HTTP, but send the completed data over HTTPS. According to Barnes, an attacker can steal in such a case via JavaScript password before the user clicks login. The final version of Firefox 44 is scheduled for January 26, 2016.

Lenovo Provides Free Recovery Media Without Superfish

Owners of a Lenovo laptop can now apply for recovery media to install Windows and additional software without even the Super Fish-adware is installed together, so has let the computer manufacturer on the private forum know. Super Fish is a program that intercepted SSL connections to inject ads. The adware used for this purpose its own root certificate. Researchers managed to crack the password using the private key of the Superfish certificate.

This makes it possible in certain cases to Man-in-the-middle attacks against systems that perform Superfish and the certificate installed. In total Superfish appeared on more than 40 different types of laptops to be installed. Because of the Superfish debacle Lenovo announced several measures. For example, published a removal tool and put the manufacturer's promise that it will provide cleaner machines with less pre-installed software in the future. Also followed a free subscription of six months on the McAfee virus scanner.

Current owners of a laptop sit with the problem on their recovery media, such as a special recovery partition, Superfish is still present. If the computer is reinstalled using the recovery media is also Superfish replaced. Last month, Lenovo's own forum know that they worked to restore clean media without Superfish which can be requested via the support department. An employee of Lenovo claims that the recovery media will not be sent in bulk. "But if you need due to specific circumstances recovery media, please contact the service desk." Whether the media via CD or USB stick will be offered the employee does not know. We have asked for clarification about Lenovo.

43-Year-Old Telnet Still Popular On The Internet

It is 43 years ago this week that Jon Postel RFC 318 published a document in which he described a standard method to control terminal devices at one location from another location, now better known as Telnet (Teletype NETwork). Despite its age and the security problems that are associated with Telnet network protocol is still very popular on the Internet.

John Matherly, the developer of the search engine Shodan, collected in March sorts of information services on the Internet and discovered that Telnet on the sixth place of most state services found behind HTTP, CWMP, SIP, SSH and HTTPS. According Matherly, Telnet is still used by companies and manufacturers. Among other kinds of " smart "products. "The fact that Telnet is easy to use, easy to integrate and requested by users allows Telnet remains popular on the Internet," said Matherly.

Telnet was designed at a time when security hardly played a role and therefore does not have encryption. Besides all kinds of old legacy devices that still use telnet and replaced by SSH is unclear how often the protocol for new products at selected points Matherly. "But the fact remains that even for new programs and devices, and engineers Telnet preferable alternatives."Something Shodan developer both from a security and usability point of view is unwise. Recently reported that the Internet giant Akamai even in the fourth quarter of 2014 as much as 32% of all the observed attack traffic against Telnet was addressed.

Lenovo Provides Customers With Superfish-Adware 6 Months McAfee

Customers of computer manufacturer Lenovo laptop with the Superfish-adware can receive from next week try a virus McAfee for a period of six months without charge, as the company has let know .Because of the Superfish debacle Lenovo announced several measures. Was published as a removal tool and put the manufacturer's promise that it will provide cleaner machines with less pre-installed software in the future.

In addition, the customers a free subscription offer of a half years at McAfee Live Safe. The security software can be used on multiple devices and to protect systems against malware and other online threats. Duped consumers can already download the trial version of the software, to activate it, then next week on 16 March. In case users the security itself already bought their existing subscription will be extended by six months.

In total, more than 40 different types of laptops that Superfish standard was installed qualify for the program. Super Fish is a program that intercepted SSL connections to inject ads. The adware used for this purpose its own root certificate.Researchers managed to crack the password using the private key of the Superfish certificate. This makes it possible in some cases to Man-in-the-middle attacks against systems that perform Superfish and the certificate installed.

NSA Provides Tips Against Destructive Malware

Attackers who have full access to a network to steal or destroy all data on the network. It is therefore important to prevent attackers able to access and can go about their business undisturbed, according to the US Secret Service NSA in a new document on destructive malware. The report follows the attack on Sony, where assailants sabotaged thousands of computers.

"While there may be tools which in some cases may prevent the complete destroying data at that time, is a better defense to prevent an attacker can get as much control over the network." The NSA recognizes that this can be difficult in practice, but several measures can be taken to make it much harder for an attacker to unseen to get as much control over the network."The sooner network defenders can detect an intrusion, the less damage can potentially cause the attacker."

In the advisory report ( pdf ) the NSA gives several recommendations that help prevent, detect and reduce attacks. For example, recommended network segregation, so an attacker can not gain access to other parts of the network. The use of administrator rights must be limited and it is recommended deploying application whitelisting, so that unauthorized or malicious software can not be installed.

Another measure that organizations can adopt according to the NSA is to install the free Microsoft Enhanced Mitigation Experience Toolkit (EMET) or other programs that perform exploits difficult. EMET is a free program that adds a layer of security applications and Windows. This protection should make it harder to exploit any vulnerabilities in the software. The advice is further supplemented with known measures, such as the timely installation of patches and making backups.

New TLS / SSL Leak Hits Android And Apple Users

Researchers have discovered a new leak in TLS / SSL encrypted connections allowing attackers from Android and Apple users attacks. The problem that the name " FREAK Attack "has been, in some TLS / SSL servers and present clients, and allows an attacker located between the target and the Internet is the security of the TLS connection to a weak encryption can downgrade . Then this encryption can be attacked and content viewed from the protected traffic.

The vulnerability is caused by the US export policy in the early 1990s, making strong encryption could not be exported.Instead, there was only "export-grade" RSA encryption are supplied. The encryption keys were in this case only 512-bits wide.According cryptography professor Matthew Green was the 512-bit export-grade encryption weigh "dumb and dumber". "In theory was developed to ensure that the NSA communication could approach, while there could also be argued that the cryptography" "for commercial use." Good enough

According to Green led the need to support export-grade encryption to technical challenges. American servers were namely support both strong and weak encryption. The SSL developers were using a mechanism to set up a secure connection between two parties support the strongest encryption chooses which both parties. In theory, American users with American servers than strong encryption can use, while foreign clients with weak encryption are supported.

Most modern clients, such as browsers, would be to set up an encrypted connection is no export-grade encryption offer more.In addition, it was assumed that most servers nor export-grade encryption would offer more. Furthermore, an attacker in case there are still export-grade encryption for the encrypted compound was used must compute a 512-bit RSA key.

Researchers at Microsoft Research and INRIA IMDEA discovered that some modern TLS clients, including Apple's Secure Transport and OpenSSL, contain a vulnerability. Therefore they accept RSA export-grade encryption, even though they did not ask for this. According to Green, this bug has major consequences, since the attacker will connect to downgrade.However, the client in question need to be vulnerable, and the support server export-grade RSA. Contrary to what many people thought was export-grade RSA still in use. 36.7% of the 14 million websites investigated were found to support it.

"We thought that people were using it anymore," said Karthikeyan Bhargavan, a researcher from the French computer lab INRIA opposite the Washington Post . The team Bhargavan discovered the problem during testing of encryption systems.According to Nadia Heninger, a cryptographer at the University of Pennsylvania, we have here is actually a "zombie from the 1990s" to make. Heninger says that she can crack the export-grade encryption through the Amazon Web Services in 7 hours.

The vulnerability was already patched OpenSSL in January this year. Apple would now working on an update next week, and several internet parties are working to export-grade encryption to phase out. Google would now also have rolled out a patch among suppliers. However, it is up to these parties to the Android update to roll out among their users. Android users also get the advice to use a browser other than the one that comes standard.

"Turla Linux Malware" - Researchers discover espionage virus for Linux

Researchers from the Russian anti-virus firm Kaspersky Lab have discovered a spy virus for Linux that may go unnoticed for years, although for the latter is no proof yet. It is a variant of the Turla malware, also known as Snake or Urburos which all other known specimens have been developed only for Windows.

The researchers knew that there are Linux versions of Turla existed but had never yet found in the "wild" so far. Turla according to Kaspersky Lab is one of the most sophisticated espionage campaigns ever discovered . Among others, the Belgian Ministry of Foreign Affairs would have become the victim of the campaign. The now discovered Turla variant supports Linux so that there can be infected with more systems attacked organizations.

"We suspect that this part years was active in an organization attacked, but have no concrete evidence to prove it," said Costin Raiu of Kaspersky Lab. Through the malware an attacker can communicate with infected systems and execute arbitrary code. Thereby Turla do not need elevated privileges. Also, the malware can not be found via netstat, a tool that system administrators use to get an overview of open network connections.

"It uses techniques that do not require root access, so it can move freely on the system of a victim. Even if it's a regular limited user launches can continue to intercept the incoming packets and execute commands on the system," says Raiu . He notes that the Linux malware especially in other public source code is based, in which the attackers a number of things have been added. How the malware spreads exactly is not reported.