According to a research called “The Impact of Mobile Devices on Information Security” published by Check Point® Software Technologies Ltd., the number of mobile devices connected to corporate networks doubled in 2010-2011. Half of these devices contain confidential information.

The management of 70% of the surveyed companies are confident that it is the use of mobile devices that results in the increased number of data leaks. This mostly happens when devices containing corporate emails (80% of cases), client databases (around 50%) and corporate passwords (around 40%) get lost or stolen.

Corporate users are actively embracing mobile devices and services, thus creating a lot of problems for IT experts responsible for the security of corporate data. Modern standards do not cover new security threads, and yet it’s not reasonable to completely stop using mobile devices, since they give users a number of advantages that boost their performance and provide them with quick and convenient mobile access to corporate resources.

Check Point report highlights:

• In 94% of companies, the number of mobile devices connected to corporate networks has increased.
• In 78% of companies, their number has more than doubled over the past two years.
• The most popular mobile platforms used in corporate networks are:

1. Apple (30%)
2. BlackBerry (29%)
3. Android (21%)

• 43% of companies believe that Android-based devices pose a serious threat to their information security.
• The key threats undermining information security are:

1. Lack of knowledge in the information security field among corporate users (over 70%).
2. Use of mobile devices for web browsing (61%)
3. Use of unprotected wireless connections (59%)
4. Device loss of theft (58%)
5. Downloading of malicious software to mobile devices (57%).

Reuters reports that charges have been pressed by the US government against Bo Zhang, a 32-year-old China-born programmer. He is accused of illegally copying the source code of government-owned software that cost $9.5 mln to develop, to an external hard drive.

When the leak was discovered, the programmer was a part-time employee of the U.S. Federal Reserve Bank, which helped him get access to the source code of the software developed for the US Department of the Treasury.

The compromised program, called Government-wide Accounting and Reporting Program (GWA), was developed for monitoring the money transfers made by the US government and reporting to a variety of government agencies and organizations.

Once the leak was discovered, the bank initiated an internal investigation and handed the results over to the police. As the result, Bo Zhang was arrested on January 18.

The FBI did not find any signs of espionage and he was released on bail. The trial will take place on February 17 and if he is found guilty (he is being charged with the theft of government property), he may be sentenced to up to 10 years of prison.

Chaos Computer Club (CCC), a Germany-based hacker group, published a proof of the use of spyware by the government, which resulted in a serious scandal on the highest level.

The spyware mentioned in the publication was found on a laptop that belonged to a person who was suspected of illegal export of pharmaceuticals. The program was allegedly installed during a customs inspection at an airport.

This program captures the URL’s of visited websites and email communications and then sends the collected data to a remote server, presumably outside the country. Besides, it allows the operator to upload and launch any applications on a remote computer.

Joachim Hermann, the Minister of Interior of Bavaria, confirmed that state authorities in this land had been using spyware since 2009, but refused to provide specific examples. In his opinion, this practice in not in breach of any laws, although this issue is subject to further discussion. Authorities from three other lands (Baden-Württemberg, Brandenburg and Niedersachsen) also confirmed that they had been using similar software.

In response to the furious public reaction, some high-profile authorities were forced to provide comments on the situation.

Germany’s Minister of Justice, Sabine Leutheusser-Schnarrenberger, and Chancellor Angela Merkel demanded that a thorough investigation of the incident be conducted. The result of this investigation should be a mechanism aimed at protecting the citizens’ rights to privacy.

Therefore, Germany’s laws related to the use of spyware may change considerably in the nearest future.

AirPatrol has presented a new wireless security technology called ZoneDefense. This system uses a new unique approach to the prevention of corporate data leaks.

This a narrowly focused technology that prevents data leaks through mobile devices and applications. ZoneDefense integrates into the structure of a protected building (with its elements being placed in every room) and detects the location of any mobile device with 6-7 foot accuracy.

However, this is not all the system is capable of.

Not only does it allow to find devices within a protected building, but can also make them work according to system-wide rules. Depending on the rules, ZoneDefense can either allow or block the work of both devices and specific mobile applications using a number of parameters: device ownership by a specific employee, type of application, movement direction and even proximity of other devices.

This system can also set off an alarm notifying the security service about a possible data leak or detection of a suspicious device in an unauthorized area.

According to a research conducted by the Internet Development Fund, children in Europe and the NIS states usually know more about the Internet than their parents do.

From the one hand, this is a positive and logical thing. From the other hand – we don’t really know how children understand the basics of online security. Regular incidents involving Internet fraud and harassment prove that the problem is very real and the level of online threat awareness among teenagers is very low.

You can try to shield your kids from such threats in many ways, but you must be ready to face the fact that an Internet-savvy teenager won’t have any problems finding a workaround. And that is why you, as a parent, will have to explain the basics of online security to them.

Google has published a guide for parents and teachers that explains how online dangers can be avoided and how the rules of online conduct can be efficiently communicated to minors. All of these materials have been published as “Family Safety Center”.

The guide contains articles written by Google and other companies working on the problems of online security for children.

However, we should not forget than no technology, even the most advanced one, will ever be able to replace parental control and proper upbringing.

Karsten Nohl, a German network security and cryptography expert, announced the discovery of a relatively simple technique of intercepting and decrypting data transmitted over the GPRS protocol.
His team also discovered that many mobile carriers use a low-security variant of GPRS, while some of them disable GPRS traffic encryption altogether.
There can be two reasons behind such ignorant attitude of mobile carriers to the security of their clients’ data:

• An attempt to save on equipment required for proper data protection.
• Deliberate disablement of data encryption for retaining access to clients’ data.

Karsten Nohl claims that his discovery is far from being theoretical: his team was able to capture and decrypt data in T-Mobile, O2 Germany, Vodafone and E-Plus networks. What made matters worse was that they did not have to use cumbersome equipment (they used a reflashed Motorola C-123 phone) or expensive software (they only used publicly available freeware). Even in this case, they managed to capture data in the radius of 5 km.
The details of this technique have not been published yet to avoid damage to the clients of cell phone companies. The research group believes that it’s high time that mobile operators did their homework and configured their GPRS gateways and checked all cryptographic systems, as the methodology they followed will be made public shortly.
However, Russian operators were quick to react: according to “The Big Three” (Beeline, Megafon, MTS), they don’t see how this could jeopardize their clients’ security and suggest using better-protected technologies, such as 3G.

Data mining (deep data analysis) — a collective term used for a set of methods for detecting previously unknown, unusual, interpretable and practically useful knowledge in arrays of data that can be used for making decisions in various fields of human activities.

It’s common knowledge that complete privacy in today’s world is a utopian concept: our names appear in different kinds of lists and reports on a daily basis. We pay for goods and services with credit cards, use mobile phones, buy tickets… And when it comes to the Internet, we leave a colossal number of tracks: from the addresses of visited pages to search engine queries – everything can be intercepted, logged and stored in a single database.

The primary purpose of data mining lies in the analysis of huge amounts of data in such databases (involving special analytical patterns).

For instance, there is nothing suspicious about money being transferred from one account to another. Or about somebody buying a plane ticket to a large city. Or buying a large shipment of fertilizers. Or, let’s say, buying a kitchen timer or several cheap mobile phones from an online store. However, if all of these purchases were made by a single person, the local anti-terror force should definitely take a closer look.

It would seem that combining so many heterogeneous pieces of information is an immensely complex task. However, such a system is absolutely possible and may have been in operation for some time now.

The Total Information Awareness program was developed by the Pentagon from 2002 through 2003 and was aimed at detecting suspicious behavioral patterns. Following a number of public protests, it was renamed to Terrorism Information Awareness (TIA) and became nearly completely confidential. The report of the Department of Homeland Security mentions three active programs of this type. Similar solutions are being developed by other countries as well: China, the United Kingdom, Israel and Germany.

The legitimacy of such analysis is a matter of harsh public debate and none of the parties has been able to decide whether security is more important than privacy (or vice versa). And while the debate is in full swing, data collection and analysis are booming on the Internet – the Law hasn’t fully set foot on this land yet.

A scandal ignited on the web today as it turned out that Ant Video Downloader and Player, a Firefox and Internet Explorer plugin for downloading videos, spied on its users.

The plugin does its job really well — until today, it had a 5 out of 5 rating and the number of daily installations reached 7000. Its spy part was also developed by professionals: URL’s of visited sites and other personal information (associated with a unique user identifier) are sent to an unknown address even in privacy mode or when using data encryption mechanisms like Tor.

With a database of 11 million users and their visited pages, hackers can easily identify people and make their life a lot harder — just with this information at hand. It’s not yet known exactly what information was stolen and how it will be used.

Such activity of the plugin was detected by security experts on May 10th, but the plugin is still available for installation in Firefox and Internet Explorer. Unfortunately, there is no efficient way of blocking such spyware and its activities at the moment.

Symantec (a leading information security software development company) is warning that one of the most popular networks in the world, Facebook.com, may have been leaking personal information for several years.

Experts believe that advertisers on the social network obtained information not only on customer profiles but also pages containing photo albums and personal correspondence. Moreover, they have the ability to post fake messages.

The social network’s applications also have a problem with personal information security. Experts believe that leaks are possible from over 100 thousand applications.

Facebook management have been informed of these issues and are already taking steps to guarantee users’ security. However, there has so far been no comment from the company.

Pete Warden and Alasdair Allan, British IT experts, have found out that Apple phones and tablets equipped with a 3G module save users’ location details to a hidden file.

This information (similar to GPS logs in GPX or KML formats) is stored in a file called consolidated.db in an open form and is copied to the PC during synchronization or backup.

This function was found in all iOS versions starting from version 4. This way, anyone with access to another user’s PC or phone will also have access to a large database of fairly accurate data about the device owner’s physical locations since June 2010 (when iOS 4 was released).

Warden and Allan created a compact parser for Mac computers that allows users to project the coordinates collected by the device onto a map.

Relative inaccuracy or the logged coordinates proves that they are not collected using a built-in GPS receiver, but are calculated using the coordinates of base stations in GSM networks. Apple has not provided any comments on this situation.