macOS High Sierra App Store Preferences Can Be Unlocked Without a Password

A new password bug has been discovered in the latest version of macOS High Sierra that allows anyone with access to your Mac to unlock App Store menu in System Preferences with any random password or no password at all. The vulnerability impacts macOS version 10.13.2 and requires the attacker to be logged in with an administrator-level account for this vulnerability to work.

If you're running latest macOS High Sierra, check yourself:

• Log in as a local administrator
• Go to System Preferences and then App Store
• Click on the padlock icon (double-click on the lock if it is already unlocked)
• Enter any random password (or leave it blank) in login window
• Click Unlock, done!

Once done, you'll gain full access to App Store settings, allowing you to modify settings like disabling automatic installation of macOS updates, app updates, system data files and even security updates that would patch vulnerabilities.

6 Tips to Protect Against Technical Support Fraud

Tech support scams have become big business for criminals, so don’t expect them to stop over the holidays. In fact, the FBI’s most recent Internet Crime Report lists tech support fraud as one of the top cybercrime trends, costing victims some $8 million last year alone. Since 2015, according to a Microsoft spokesperson, the company has received more than 300,000 customer reports of tech support fraud and the software company receives an average of 12,000 reports of tech support scams a month worldwide.

Some scammers call and claim to be computer techs associated with well-known companies like Microsoft or Apple. Other scammers send pop-up messages that warn about computer problems. They say they’ve detected viruses or other malware on your computer. They claim to be “tech support” and will ask you to give them remote access to your computer. Eventually, they’ll diagnose a non-existent problem and ask you to pay for unnecessary – or even harmful – services.

If you get an unexpected pop-up, call, spam email or other urgent message about problems with your computer, stop. Don’t click on any links, don’t give control of your computer and don’t send any money.

How the Scam Works

Scammers may call, place alarming pop-up messages on your computer, offer free “security” scans, or set up fake websites – all to convince you that your computer is infected. The scammers try to get you on the phone, and then work to convince you there’s a problem. Finally, they ask you to pay them to fix that non-existent problem.

To convince you that both the scammers and the problems are real, the scammers may:

• pretend to be from a well-known company – like Microsoft or Apple
• use lots of technical terms
• ask you to get on your computer and open some files – and then tell you those files show a problem (when they don’t)

Then, once they’ve convinced you that your computer has a problem, the scammers might:

• ask you to give them remote access to your computer – which lets them change your computer settings so your computer is vulnerable to attack
• trick you into installing malware that gives them access to your computer and sensitive data, like user names and passwords
• try to sell you software that’s worthless, or that you could get elsewhere for free
• try to enroll you in a worthless computer maintenance or warranty program
• ask for credit card information so they can bill you for phony services, or services you could get elsewhere for free
• direct you to websites and ask you to enter your credit card number and other personal information

These scammers want to get your money, access to your computer, or both. But there are things you can do to stop them.

If You Get a Call or Pop-Up

• If you get an unexpected or urgent call from someone who claims to be tech support, hang up. It’s not a real call. And don’t rely on caller ID to prove who a caller is. Criminals can make caller ID seem like they’re calling from a legitimate company or a local number.

• If you get a pop-up message that tells you to call tech support, ignore it. There are legitimate pop-ups from your security software to do things like update your operating system. But do not call a number that pops up on your screen in a warning about a computer problem.

• If you’re concerned about your computer, call your security software company directly – but don’t use the phone number in the pop-up or on caller ID. Instead, look for the company’s contact information online, or on a software package or your receipt.
• Never share passwords or give control of your computer to anyone who contacts you.

If You Were Scammed

• Get rid of malware. Update or download legitimate security software and scan your computer. Delete anything the software says is a problem.
• Change any passwords that you shared with someone. Change the passwords on every account that uses passwords you shared.
• If you paid for bogus services with a credit card, call your credit card company and ask to reverse the charges. Check your statements for any charges you didn’t make, and ask to reverse those, too. Report it to ftc.gov/complaint.

Refund Scams

If you paid for tech support services, and you later get a call about a refund, that call is probably also a scam. Don’t give the person any personal or financial information.

The refund scam works like this: Several months after a purchase, someone calls to ask if you were happy with the service. If you say “No”, the scammer offers a refund. Or, the caller says the company is going out of business and giving refunds. The scammer eventually asks for your bank or credit card account number, or asks for access to your bank account to make a deposit. But instead of putting money in your account, the scammer takes money from your account.

If you get a call like this, hang up, and report it: ftc.gov/complaint.

WhatsApp Flaw Could Allow 'Potential Attackers' to Spy On Encrypted Group Chats

A more dramatic revelation of 2018—an outsider can secretly eavesdrop on your private end-to-end encrypted group chats on WhatsApp and Signal messaging apps. Considering protection against three types of attackers—malicious user, network attacker, and malicious server—an end-to-end encryption protocol plays a vital role in securing instant messaging services.

The primary purpose of having end-to-end encryption is to stop trusting the intermediate servers in such a way that no one, not even the company or the server that transmits the data, can decrypt your messages or abuse its centralized position to manipulate the service.

In order words—assuming the worst-case scenario—a corrupt company employee should not be able to eavesdrop on the end-to-end encrypted communication by any mean.

However, so far even the popular end-to-end encrypted messaging services, like WhatsApp, Threema and Signal, have not entirely achieved zero-knowledge system.

Researchers from Ruhr-Universität Bochum (RUB) in Germany found that anyone who controls WhatsApp/Signal servers can covertly add new members to any private group, allowing them to spy on group conversations, even without the permission of the administrator.

As described by the researchers, in the pairwise communication (when only two users communicate with each other) server plays a limited role, but in case of multi-user chats (group chat where encrypted messages are broadcasted to many users), the role of servers increases to manage the entire process.

That's where the issue resides, i.e. trusting the company's servers to manage group members (who eventually have full access to the group conversation) and their actions.

As explained in the newly published RUB paper, titled "More is Less: On the End-to-End Security of Group Chats in Signal, WhatsApp, and Threema," since both Signal and WhatsApp fail to properly authenticate that who is adding a new member to the group, it is possible for an unauthorized person—not a group administrator or even a member of the group—to add someone to the group chat.

What's more? If you are wondering that adding a new member to the group will show a visual notification to other members, it is not the case.

According to the researchers, a compromised admin or rogue employee with access to the server could manipulate (or block) the group management messages that are supposed to alert group members of a new member.

"The described weaknesses enable attacker A, who controls the WhatsApp server or can break the transport layer security, to take full control over a group. Entering the group, however, leaves traces since this operation is listed in the graphical user interface. The WhatsApp server can therefore use the fact that it can stealthily reorder and drop messages in the group," the paper reads.

"Thereby it can cache sent messages to the group, read their content first and decide in which order they are delivered to the members. Additionally, the WhatsApp server can forward these messages to the members individually such that a subtly chosen combination of messages can help it to cover the traces."

WhatsApp has acknowledged the issue, but argued that if any new member is added to a group, let's say by anyone, other group members will get notified for sure.

"We've looked at this issue carefully. Existing members are notified when new people are added to a WhatsApp group. We built WhatsApp so group messages cannot be sent to a hidden user," a WhatsApp spokesperson said.

"The privacy and security of our users is incredibly important to WhatsApp. It's why we collect very little information and all messages sent on WhatsApp are end-to-end encrypted."

But if you are not part of a group with very selected members, I'm sure many of you would relatively ignore such notifications easily.

Researchers also advised companies to fix the issue just by adding an authentication mechanism to make sure that the "signed" group management messages come from the group administrator only.

However, this attack is not easy (exception—services under legal pressure) to execute, so users should not be worried about it.

Wi-Fi Alliance Launches WPA3 Protocol with New Security Features

The Wi-Fi Alliance has finally announced the long-awaited next generation of the wireless security protocol—Wi-Fi Protected Access (WPA3). WPA3 will replace the existing WPA2—the network security protocol that has been around for at least 15 years and widely used by billions of wireless devices every day, including smartphones, laptops and Internet of things.

However, WPA2 has long been considered to be insecure due to its common security issue, that is "unencrypted" open Wi-Fi networks, which allows anyone on the same WiFi network to intercept connections on other devices.

Most importantly, WPA2 has also recently been found vulnerable to KRACK (Key Reinstallation Attack) that makes it possible for attackers to intercept and decrypt Wi-Fi traffic passing between computers and access points.

The new standard of Wi-Fi security, which will be available for both personal and enterprise wireless devices later this year, offers improved security and privacy.

• WPA3 protocol strengthens user privacy in open networks through individualised data encryption.
• WPA3 protocol will also protect against brute-force dictionary attacks, preventing hackers from making multiple login attempts by using commonly used passwords.
• WPA3 protocol also offers simplified security for devices that often have no display for configuring security settings, i.e. IoT devices.
• Finally, there will be a 192-bit security suite for protecting WiFi users’ networks with higher security requirements, such as government, defence and industrial organisations.

"Wi-Fi security technologies may live for decades, so it’s important they are continually updated to ensure they meet the needs of the Wi-Fi industry," said Joe Hoffman, SAR Insight & Consulting. "Wi-Fi is evolving to maintain its high-level of security as industry demands increase."

Since hardware must get certified by the Wi-Fi Alliance to use WPA3 security protocol, the new security standard won't arrive overnight.

It could take months for device manufacturers to support the new wireless security standard, but the first WPA3-certified devices are expected to ship later this year. More details about WPA3 have yet to be released.

CES 2018: The Best Gadgets Yet

Rokid

Glass

In the near future, augmented reality wearables will slide into our lives as seamlessly as iPhones and Fitbits. Rokid's AR glasses? Well, those aren't quite there yet. The Chinese company's prototype is chunky, clunky, and totally ugly—but even in its rudimentary form, we were impressed with what they could do. The glasses show information in the corner of the lens, including surprisingly reliable facial recognition tech that tells you who's around. It's a compelling proof of concept of what AR wearables will be capable of before 2018 is over.

Raven

H

The Raven H is a unique and versatile smart home device—it’s a speaker, a voice-activated assistant, and a touch-sensitive home entertainment remote, all in one. The sharp design comes courtesy of Swedish audio and electronics firm Teenage Engineering. Even more fun, Raven is owned by Chinese web services giant Baidu, so when you talk to the little LED-dotted square on top, you’re interacting with DuerOS, Baidu’s rapidly growing AI platform. There’s just one catch: You’ll need to talk to it in Chinese.

Garmin

Speak Plus

Someday, all cars will have Alexa and 5G and the infotainment system of your dreams. Today is not that day. Garmin's Speak Plus helps bridge the gap: It plugs into your car's cigarette adapter, connects to your phone over Bluetooth, and sticks to your windshield. From its perch, this round gizmo provides a dash cam, turn-by-turn navigation, and all of Alexa's many other skills. If you connect it to your stereo (again over Bluetooth), you can even use your voice to control your music. It's not quite as simple as an integrated setup, but at $230 it won't require a bank loan just to get one.

Nokia

Sleep Sensing and Home Automation Pad

Nokia's dream for the connected home starts when you slip into bed each night. Control IoT devices with its new sleep system as soon as you hit the hay: Turn off the lights. Tick the thermostat down a few notches. Set the home security system. Set your phone to "do not disturb" mode. While you snooze, it also tracks sleep cycles, heart rate, and snoring patterns through a thin pad that slips under the mattress.

Seven Dreamers

Laundroid

Folding laundry is a genuine hassle. Enter the Laundroid: a ludicrously large, refrigerator-sized robotic dresser that folds your clothes for you. It has a bin at the bottom where you drop your clean clothes, and on the inside a series of robotic arms and cameras analyze each piece of clothing and fold it. If it ever comes out (and that’s a long shot), it will cost somewhere in the neighborhood of $16,000. But in a tech conference filled with a lot of genuinely useless ideas, at least Laundroid is trying to make life legitimately easier. The company even says that it’s partnering with a laundry machine maker so a future Laundroid can actually launder your clothes too.

Wagz

Smart Dog Collar

Most connected pet products (most connected products in general, really) don't offer any features of real value. Wagz seems to at least be thinking about it more holistically, developing a set of gadgets that work together to actually help out pets and their owners. Its smart collar tracks your pooch anywhere it goes, but it also acts as an ID, telling the Wagz smart feeder how much food to spit out. And when your mutt walks over to the Wagz smart door, it'll only open if it's the right dog and the right time. You can manage all your pets' schedules on your phone, or just open up the feeder if you're going to be home a few minutes late.

Willow

Wearable Breast Pump

If you’re a working mom with a nursing infant, pumping breast milk is a royal pain. Too few improvements have been in this category for much too long. But now? The Willow Pump make its way onto the market this March. It’s small enough to throw into a purse, great-looking, and so quiet and discreet that a pumping mom had it running inside her shirt at a CES demo. And we had no idea.

Suunto

3 We love Suunto’s sleek, gorgeous fitness watches and the Suunto 3 is no exception. It’s light, attractive, versatile, easy to navigate, and can turn a huge amount of data—like your heart rate and V02 max—into a personalized 10-day training plan.

Scotts

Gro Smart Garden Irrigation System

Successfully watering your outdoor garden requires processing a huge amount of information: Type of plant, plant hardiness zone, soil quality, and the day’s precipitation (or lack thereof). If you find that poring over this information is a satisfying task, more power to you. But if you’d like to eliminate the guesswork, save water, and optimize your tomato growth, Scott’s smart irrigation system can help. It tailors your watering schedule to satellite weather updates, soil conditions, and plant variety, and can be monitored from your smartphone.

Amy Lombard for WIRED

Blade

Shadow PC

Building a gaming PC is an expensive proposition, and the antidote is Shadow PC. This service ties into a powerful gaming computer in the cloud (the company compares each virtual rig to an i7 PC with 12 GB RAM and Nvidia graphics) that’s always kept up-to-date on the backend. So, instead of popping in a new graphics card or upping the RAM, you just keep paying $35 per month and the upgrades are included. The company’s compact $135 Shadow Box will let you turn any monitor, PC, and mouse into a system hardcore enough to run games at up to 4K/60.