Inconsistent, misleading password meters can increase risk of cyber attacks: Study

Agencies
December 23, 2019

Washington D.C., Dec 23: Inconsistent and misleading advice offered on some of the world's most popular websites could actually be doing more harm than good, says a recent study.

Password meters">Password meters are frequently made available to help the users secure their personal data against the threats posed by cybercriminals.

The study conducted at the University of Plymouth has assessed the effectiveness of 16 password meters that people are likely to use or encounter on a regular basis.

The research says that there is a clear level of variation in the advice offered across different websites.

The study was published in the journal Computer Fraud and Security.

The main focus was dedicated password meter websites, but the study also sought to assess those embedded in some common online services (including Dropbox and Reddit) and those found as standard on some of our devices.

And while some meters do effectively steer users towards more secure account passwords, some will not pick them up when they try to use 'abc123', 'qwertyuiop' and 'iloveyou' - all listed this week among the worst passwords of 2019.

The study was conducted by Steve Furnell, Professor of Information Security and Leader of the University's Centre for Security, Communications and Network Research.

Commenting on the latest research, Prof Furnell said: "Over the festive period, hundreds of millions of people will receive technology presents or use their devices to purchase them."

"The very least they should expect is that their data will be secure and, in the absence of a replacement for passwords, providing them with consistent and informed guidance is key in the quest for better security."

"What this study shows is that some of the available meters will flag an attempted password as being a potential risk whereas others will deem it acceptable. Security awareness and education are hard enough, without wasting the opportunity by offering misleading information that leaves users misguided and with a false sense of security."

The study tested 16 passwords against the various meters, with 10 of them being ranked among the world's most commonly used passwords (including 'password' and '123456').

Of the 10 explicitly weak passwords, only five of them were consistently scored as such by all the password meters, while 'Password1!' performed far better than it should do and was even rated strongly by three of the meters.

However, one positive finding was that a browser-generated password was consistently rated strong, meaning users can seemingly trust these features to do a good job.

Prof Furnell added: "Password meters">Password meters themselves are not a bad idea, but you clearly need to be using or providing the right one."

"It is also worth remembering that, regardless of how the meters handled them, many systems and sites would still accept the weak passwords in practice and without having offered users any advice or feedback on how to make better choices," he added.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
January 3,2020

Giving each and every app access to personal information stored on Android smartphones such as your contacts, call history, SMS and photos may put you in trouble as bad actors can easily use these access to spy on you, send spam messages and make calls anywhere at your expense or even sign you up for a premium "service", researchers from cybersecurity firm Kaspersky have warned.

But one can restrict access to such information as Android lets you configure app permissions. 

Giving an app any of these permissions generally means that from now on it can obtain information of this type and upload it to the Cloud without asking your explicit consent for whatever it intends to do with your data.

Therefore, security researchers recommend one should think twice before granting permissions to apps, especially if they are not needed for the app to work. 

For example, most games have no need to access your contacts or camera, messengers do not really need to know your location, and some trendy filter for the camera can probably survive without your call history, Kaspersky said. 

While decision to give permission is yours, the fewer access you hand out, the more intact your data will be.

Here's what you should know to protect your data.

SMS: An app with permission to send and receive SMS, MMS, and WAP (Wireless Application Protocol) push messages, as well as view messages in the smartphone memory will be able to read all of your SMS correspondence, including messages with one-time codes for online banking and confirming transactions.

Using this permission, the app can also send spam messages in your name (and at your expense) to all your friends. Or sign you up for a premium "service." You can see and conrol which apps have these rights by going to the settings of your phone.

Calendar: With permission to view, delete, modify, and add events in the calendar, prying eyes can find out what you have done and what you are doing today and in the future. Spyware loves this permission.

Camera: Permission to access the camera is necessary for the app to take photos and record video. But apps with this permission can take a photo or record a video at any moment and without warning. Attackers armed with embarrassing images and other dirt on you can make life a misery, according to Kaspersky.

Contacts: With permission to read, change, and add contacts in your address book, and access the list of accounts registered in the smartphone, an app can send your entire address book to its server. Even legitimate services have been found to abuse this permission, never mind scammers and spammers, for whom it is a windfall.

This permission also grants access to the list of app accounts on the device, including Google, Facebook, and many other services.

Phone: Giving access to your phone means permission to view and modify call history, obtain your phone number, cellular network data, and the status of outgoing calls, add voicemail, access IP telephony services, view numbers being called with the ability to end the call or redirect it to another number and call any number.

This permission basically lets the app do anything it likes with voice communication. It can find out who you called and when or prevent you from making calls (to a particular number or in general) by constantly terminating calls. 

It can eavesdrop on your conversations or, of course, make calls anywhere at your expense, including to pay-through-the-nose numbers, Kaspersky warned.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
July 4,2020

The Mars Colour Camera (MCC) onboard ISRO's Mars Orbiter Mission has captured the image of Phobos, the closest and biggest moon of Mars.

The image was taken on July 1 when MOM was about 7,200 km from Mars and 4,200 km from Phobos.

"Spatial resolution of the image is 210 m.

This is a composite image generated from 6 MCC frames and has been color corrected," ISRO said in an update along with the image.

Phobos is largely believed to be made up of carbonaceous chondrites.

According to ISRO, "the violent phase that Phobos has encountered is seen in the large section gouged out from a past collision (Stickney crater) and bouncing ejecta."

"Stickney, the largest crater on Phobos along with the other craters (Shklovsky, Roche & Grildrig) are also seen in this image," it said.

The mission also known as Mangalyaan was initially meant to last six months, but subsequently ISRO had said it had enough fuel for it to last "many years."

The country had on September 24, 2014 successfully placed the Mars Orbiter Mission spacecraft in orbit around the red planet, in its very first attempt, thus breaking into an elite club.

ISRO had launched the spacecraft on its nine-month- long odyssey on a homegrown PSLV rocket from Sriharikota in Andhra Pradesh on November 5, 2013.

It had escaped the earth's gravitational field on December 1, 2013.

The Rs 450-crore MOM mission aims at studying the Martian surface and mineral composition as well as scan its atmosphere for methane (an indicator of life on Mars).

The Mars Orbiter has five scientific instruments - Lyman Alpha Photometer (LAP), Methane Sensor for Mars (MSM), Mars Exospheric Neutral Composition Analyser (MENCA), Mars Colour Camera (MCC) and Thermal Infrared Imaging Spectrometer

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
May 10,2020

In the wake of the gas leak at a factory in Visakhapatnam, the National Disaster Management Authority (NDMA) has issued detailed guidelines for restarting industries after the lockdown and the precautions to be taken for the safety of the plants as well as the workers.

In a communication to all states and union territories, the NDMA said due to several weeks of lockdown and the closure of industrial units, it is possible that some of the operators might not have followed the established standard operating procedures.

As a result, some of the manufacturing facilities, pipelines, valves may have residual chemicals, which may pose risk. The same is true for the storage facilities with hazardous chemicals and flammable materials, it said.

The NDMA guidelines said while restarting a unit, the first week should be considered as the trial or test run period after ensuring all safety protocols.

Companies should not try to achieve high production targets. There should be 24-hour sanitisation of the factory premises, it said.

The factories need to maintain a sanitisation routine every two-three hours especially in the common areas that include lunch rooms and common tables which will have to be wiped clean with disinfectants after every single use, it added.

For accommodation, the NDMA said, sanitisation needs to be performed regularly to ensure worker safety and reduce the spread of contamination.

To minimise the risk, it is important that employees who work on specific equipment are sensitised and made aware of the need to identify abnormalities like strange sounds or smell, exposed wires, vibrations, leaks, smoke, abnormal wobbling, irregular grinding or other potentially hazardous signs which indicate the need for immediate maintenance or if required shutdown, it said.

At least 11 people lost their lives and about 1,000 others were exposed to a gas leak at a factory in Andhra Pradesh''s Visakhapatnam on May 7.

The incident took place after it restarted operations when the government allowed industrial activities in certain sectors following several weeks of lockdown.

The lockdown was first announced by Prime Minister Narendra Modi on March 24 for 21 days in a bid to combat the coronavirus threat. The lockdown was then extended till May 3 and again till May 17.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.