FCC offers security advice to smartphone users

IDG News Service - The U.S. Federal Communications Commission is advising smartphone users on how to protect their mobile devices and data from mobile security threats.

The Commission released an online tool called the "Smartphone Security Checker" on Tuesday that outlines a 10-step action plan that mobile users can follow to prevent their personal data from being exposed in case their devices get infected with malware or are lost, stolen or resold.

The tool provides recommendations including: locking access to the phone with PINs or passwords; avoiding changing the phone's factory security settings or rooting/jailbreaking the phone; backing up the phone data regularly in the cloud, on a computer or on a removable memory card; installing apps only from trusted sources and after checking their user reviews; reviewing and understanding the permissions requested by applications before installing them; installing the firmware updates issued by the manufacturer; installing security apps that allow remote locking and wiping of the phone; avoiding connecting to the Internet from untrusted wireless hotspots; wiping data from the phones before reselling; donating or recycling devices; and reporting stolen devices to the authorities and the operator for inclusion in a national database of stolen smartphones.

The recommendations were drafted by the FCC in collaboration with the U.S. Department of Homeland Security; the Federal Trade Commission; the National Cyber Security Alliance; CTIA, a wireless industry trade association; and other public and private sector partners including antivirus vendors and cybersecurity organizations.

The tool allows smartphone owners to choose their device's OS. The available options are Android, Apple iOS, BlackBerry and Windows Phone. The steps are the same for all types of devices for the most part, but depending on the OS choice they might include links to OS-specific instructions for performing certain recommended actions.

The FCC checklist is one of the most comprehensive sets of rules for safeguarding smartphone devices and data published so far, said Bogdan Botezatu, a senior e-threat analyst at antivirus vendor Bitdefender.

"However, some provisions, although they make sense 'on paper,' are impossible to control by the user," he said. "For instance, most smartphones cannot be updated because vendors do not provide any security fixes past the maximum Android version supported by the respective hardware. Android versions from 2.3 to 2.3.3 are vulnerable to a number of known bugs -- some of them quite severe, such as USSD attacks -- but mobile phone vendors and carriers have stopped update delivery. In this context, the user is forced to either put up with an unsecured device that can be exploited at any time or to root their gadget and manually update its firmware."

Reprinted with permission from IDG.net. Story copyright 2012 International Data Group. All rights reserved.

View the original article here

Instagram users in uproar over plans to sell their pics

Computerworld - Instagram has alerted its users to a change in its Terms of Use policy, and users are in an uproar about it.

The popular photo-sharing app, which was recently acquired Facebook, said in its new policy that it has the option to license users' photos and sell them to advertisers or other companies.

"Instagram does not claim ownership of any Content that you post on or through the Service," the company says in its new Terms of Use . "Instead, you hereby grant to Instagram a non-exclusive, fully paid and royalty-free, transferable, sub-licensable, worldwide license to use the Content that you post on or through the Service, except that you can control who can view certain of your Content and activities on the Service as described in the Service's Privacy Policy, available here: http://instagram.com/legal/privacy/."

Another part of the Terms of Use concerns advertising: "Some or all of the Service may be supported by advertising revenue," the company writes. "To help us deliver interesting paid or sponsored content or promotions, you agree that a business or other entity may pay us to display your username, likeness, photos (along with any associated metadata), and/or actions you take, in connection with paid or sponsored content or promotions, without any compensation to you."

The changes have a lot of users complaining and threatening to stop using the Instagram service. Twitter lit up with Instagram complaints and jokes.

"That's it! I'm raising my middle finger in each photo I take with Instagram, let's see how they're gonna sell that! #BoycottInstagram," tweeted @MenHumor.

@iamBenLyons tweeted, "Bye Bye Instagram. We hardly knew you. What's next?" while @everywhereist tweeted, "Oh no! That sepia toned photo of last week's sushi dinner has fallen into the wrong hands!"

Instagram did not respond to a request for comment.

Ezra Gottheil, an analyst with Technology Business Research, said Instagram's policy change is causing a big enough flap to create a problem for the company.

"I hope this really is a user revolt," he said. "It is pretty revolting, but Facebook has gotten away with serial violations of privacy in the past. But maybe selling your photographs is a bridge too far."

He added that this has become a big issue because it deals with users' property rights, rather than privacy rights.

"'I'm afraid most Facebook users don't care much about privacy, but apparently, they care about property," he noted. "I like this because it reminds people that their content has value."

Facebook, which now owns Instagram, certainly has seen its share of privacy flaps. Users repeatedly have threatened to stop using Facebook over one privacy issue or another but the company still remains the largest social network in the world, by far.

Will these user complaints actually cause real trouble for Instagram? Gottheil said they might.

Noting that the pictures might not carry much value, Instagram may not want to fight this out with its users.

"I hope it makes them pay more attention to Terms of Use and privacy issues," he said. "Facebook, I think, would actually benefit from being more careful with their users' data."

Instagram's policy changes are set to go into effect Jan. 16.

Read more about Social Media in Computerworld's Social Media Topic Center.

The next big breakthrough in IT management is here. Learn how you can reduce change risk, speed incident resolution, and improve visibility across your environment with Social IT Operations Management.

Read now.

View the original article here

Java 7 update 10 lets users restrict Java apps in browsers

IDG News Service - A recent Java 7 update allows users to completely prevent Java applications from running inside browsers or to restrict how Web-based Java content is handled by the Java Runtime Environment (JRE) client. These features will benefit security-conscious users, but companies still have to find methods of isolating older Java versions, security experts say.

Java 7 Update 10 (7u10), released on Dec. 11, does not address any security vulnerabilities, but provides several security enhancements. According to its release notes, the new version provides users with "the ability to disable any Java application from running in the browser." This can be done from the "Security" tab on the Java control panel by clearing the "enable Java content in the browser" checkbox.

Security experts have long advised users to remove the Java plug-in from their Web browsers in order to protect themselves from the increasingly prevalent Web-based attacks that exploit Java vulnerabilities to infect computers with malware. However, in order to follow this advice users had to remove the plug-in from all of their browsers one by one and were often forced to redo the process after installing new Java updates.

Java 7u10 seems to make things easier by providing users with a central and persistent option for controlling Web-based Java content regardless of how many browsers they use. In addition, the new Java version provides users who can't afford to completely block such content with a method of controlling how potentially dangerous applets are handled.

Starting with Java 7u10 users have to ability to set security levels from low to very high for Web-based Java content, with medium being the default option. The medium security level will allow unsigned Java apps to run, but only if the Java version is considered secure. "You will be prompted if an unsigned app requests to run on an old version of Java," Oracle said in the tech notes for the new control panel security options.

Setting the security level to very high will prompt the user for permission every time a Java app, signed or unsigned, attempts to run in the browser. If the Java version is deemed insecure, unsigned apps won't run at all, regardless of what the user decides.

"The Security Level setting affects unsigned plug-in applets, Java Web Start applications, embedded JavaFX applications, and access to the native deployment toolkit plugins," Oracle said.

In addition, Java 7u10 introduces new dialogs that warn users when the installed JRE version is insecure and needs to be updated.

These changes don't make Java more secure in itself, but will likely make it easier for users to make their PCs more secure because they allow users to manage certain restrictions, Thomas Kristensen, chief security officer at vulnerability research and management firm Secunia, said Tuesday via email. However, in order for the majority of users to be protected, Oracle needs to set the new options in a restrictive way by default, because most users won't understand or know about the new restrictions, he said.

Reprinted with permission from IDG.net. Story copyright 2012 International Data Group. All rights reserved.

View the original article here