Terms and Conditions
Please note that when accessing The F-Secure World Wide Web pages you agree to the following terms:
The contents of F-Secure World Wide Web pages are provided “as is” and “as available”. No warranty of any kind, either express or implied, is made in relation to the availability, accuracy, reliability or content of these pages. To the extent permitted by law, F-Secure shall not be liable for any direct, indirect, incidental or consequential damages arising out of the use of or inability to use these pages, even if F-Secure has been advised of the possibility of such damages.
Third Party Sites
This policy only addresses our activities from our servers. This web site contains links to web sites that are not under our control. We are not responsible for the content, commentary or applications of these web sites. We are providing these links only as a convenience and the inclusion of these links does not imply endorsement by us of the linked web site.
The contents of F-Secure World Wide Web pages are protected by international copyright laws © F-Secure 1994 – 2006. All rights reserved. Reproduction, transfer, distribution or storage of part, or all of the contents, including but not limited to pictures, design format, logo, audio clips, video clips and HTML coding, in any form without the prior written permission of F-Secure is prohibited. Any and all reproduction, total or partial, of the texts, illustrations, design format or logo by any means whatsoever, is illegal. Such reproduction requires the prior written consent of F-Secure. We protect our intellectual property rights to the full extent of the law. F-Secure” and the triangle symbol are registered trademarks of F-Secure Corporation and F-Secure product names and symbols/logos are either trademarks or registered trademarks of F-Secure Corporation.
All other trademarks mentioned in the F-Secure World Wide Web pages are the property of their respective holders. Nokia is a registered trademark and the Nokia OK logo is a trademark of Nokia Corporation. Nokia id-codes are a00014, a00015 and a00018. Symbian and all Symbian-based marks and logos are trade marks of Symbian Limited.
F-Secure is committed to ensuring the security of your information. To prevent unauthorized access or disclosure, maintain data accuracy, and ensure the appropriate use of information, we have put in place appropriate physical, electronic, and managerial procedures to s afeguard and secure the information we collect online.
Any bulletin messages, suggestions, ideas, bulletin board postings or concepts that are submitted to F-Secure via this web site shall become, and remain the property of F-Secure. Furthermore, F-Secure is not responsible for the confidentiality of any information communicated to our web site. By communicating material to the F-Secure web site, you agree that F-Secure has the right to publish the material in products or publications for any purpose, including, but not limited to, advertising and promotional purposes. You agree not to take action against us in relation to material that you submit.
F-Secure reserves the right to modify the pages or deny access to them at any time. Amendments to this policy will be posted at this URL and will be effective when posted. Please visit us again for updates.
The following legal terms (“terms”) govern your right to use and access to F-Secure blog “Safe and Savvy” (“blog”) provided by F-Secure Corporation (“F-Secure”, “we”, “our”). By using or visiting the blog you have read these terms, understand them and agree to be legally bound by them. You also agree not to use the blog against these terms and specific instructions elsewhere in the blog. If you do not agree to all of these terms, or if you are below the age of twelve (12), you are not allowed to access, visit or participate in the community
Description and Purpose
F-Secure provides this blog as a service to its users and customers, to help them exchange ideas, tips, information, and techniques related to overall security related issues and to our services. This blog is here for the enjoyment and benefit of all members and accessible to all. The community of the blog, like any community, is most valuable when everyone obeys certain basic guidelines and rules for online behavior:
Posting and Prohibited Content
Use of the blog is at your own risk. Do not post any information, especially personal information such as addresses and phone numbers, that you do not wish to make public. Any information that you post to public sections of the blog can be obtained and used by others. You are responsible for any personal information you disclose to the blog. F-Secure or WordPress.com provided by Automattic Inc. (“Platform Provider”) is not responsible for third parties’ use of information posted on the blog and to the blog community. Users of the blog agree not to upload, post, or otherwise transmit any content that includes any of the following inappropriate content:
- Content that is: unlawful, libelous, harmful, vulgar, obscene, derogatory, pornographic, abusive, harassing, threatening, hateful, objectionable with respect to race, religion, creed, national origin or gender;
- Any private or personal information or content that is not your own or that you do not have rights to transmit, such as: address, phone number, personal email address, social security number and copyrighted content, trade secrets or securities
- Off-topic content not relevant to blog community purpose;
- Spam, such as advertising, promotion or solicitation, including chain letters, class action lawsuits, charitable appeals;
- Content or links to content that contains contaminating or destructive features that may damage someone else’s computer;
- Duplicate or excessively repeated submissions in one or more areas;
- Content designed to evade profanity or other filters;
- Hyperlinks to sites that violate the terms;
- Content used to impersonate another person;
- Content or behavior that violates any applicable laws;
- Content or behavior that interferes with the operation of the site or with another member’s ability to use the site;
- Evading site controls such as bans, or otherwise disregarding the directions of the site moderators or administrators
- Content that infringes copyrights or other intellectual property rights of third parties.
F-Secure may remove any information, in its sole discretion, including but not limited to personal data or data, material or content provided by any of the users, considered to violate the Terms or be inappropriate for the blog for any reason. F-Secure shall under this agreement have no obligation to monitor any of the material provided by you to F-Secure and/or to the blog community, but may do so at its discretion. F-Secure also retains the right to immediately revoke any and all of Your access rights in case Your breach of any of these Terms or suspected misuse of the blog.
To report violations, please contact the F-Secure blog team and include the blog-post/comment and the author-name in question: email@example.com
Update your iPhone right now — especially if you’re an activist
A little iPhone history was made this month -- a iOS device was infected by just clicking on a link. This sort of attack had previously only worked on devices where the owner had purposely installed a "jailbreak" hack. So before you do anything -- even read the rest of this post -- you should update your iOS software to the latest version of iOS 9, or iOS 10 beta, which has some nice new privacy features. Here's how this historic attack happened, according to The Verge: Earlier this month, an Emirati human rights activist named Ahmed Mansoor got a suspicious text. It promised new details of torture in the country’s state prisons, along with a link to follow if he was interested. If Mansoor had followed the link, it would have jailbroken his phone on the spot and implanted it with malware, capable of logging encrypted messages, activating the microphone and secretly tracking its movements. To our cyber security advisor Erka Koivunen, this is a glaring example of a threat that is not "advanced" -- as in APT, advanced persistent threat. Think about what goes into a real APT. "They do reconnaissance properly and understand what the victim is susceptible to. They have good timing and only create visible noise when it suits their interest," he told us. "And they have a plan B ready in case someone starts snooping their activities." Here, the the most exploitable iPhone vulnerability ever known has now been exposed and patched -- for what? It's a bit baffling to Erka who compares it to throwing "expensive exploits at this guy like kids throwing rocks." You just don't see zero-day vulnerabilities like this -- especially on what had been one of the more secure platforms available -- that often. This has some security researchers thinking: Perverse incentives: Should I take up political activism so I get more interesting 0day sent my way? /me wonders — halvarflake (@halvarflake) August 26, 2016 //platform.twitter.com/widgets.js So, if you haven't already, update now. And if you're involved in politics in *any way* whatsoever, realize that someone will try to hack you -- sooner or later. So beware of those links in strange texts and email attachments in general. [Image by Sean MacEntee via Flickr]
Could Criminals Make A Billion Dollars With Ransomware?
Bitcoin has not only changed the economics of cybercrime by providing crooks with an encrypted, nearly anonymous payment system autonomous from any central bank. It's also changed researchers' ability to track how much money criminals are making. "Bitcoin is based on Blockchain, and Blockchain is a public ledger of transactions. So all Bitcoin transactions are public," explains Mikko Hyppönen, F-Secure's Chief Research Officer. "Now, you don’t know who is who. But we can see money moving around, and we can see the amounts." Every victim of Ransomware -- malware that encrypts files and demands a payment for their release -- is given a unique wallet to transfer money into. Once paid, some ransomware gangs move the bitcoins to a central wallet. "We've been monitoring some of those wallets," Mikko says. "And we see Bitcoins worth millions and millions. We see a lot of money." Watching crooks rake in so much money, tax-free, got him thinking: "I began to wonder if there are in fact cybercrime unicorns." A cybercrime unicorn? (View this as a PDF) A tech unicorn is a privately held tech company valued at more than a billion dollars. Think Uber, AirBNB or Spotify -- only without the investors, the overhead and oversight. (Though the scam is so profitable that some gangs actually have customer service operations that could rival a small startup.) "Can we use this comparison model to cybercrime gangs?" Mikko asks. "We probably can’t." It's simply too hard to cash out. Investors in Uber have people literally begging to buy their stakes in the company. Ransomware gangs, however, have to continually imagine ways to turn their Bitcoin into currency. "They buy prepaid cards and then they sell these cards on Ebay and Craigslist," he says. "A lot of those gangs also use online casinos to launder the money." But even that's not so easy, even if the goal is to sit down at a online table and attempt to lose all your money to another member of your gang. "If you lose large amounts of money you will get banned. So the gangs started using bots that played realistically and still lose – but not as obviously." Law enforcement is well aware of extremely alluring economics of this threat. In 2015, the FBI’s Internet Crime Complaint Center received "2,453 complaints identified as Ransomware with losses of over $1.6 million." In 2016, hardly has a month gone by without a high-profile case like Hollywood Presbyterian Medical Center paying 40 Bitcoin, about $17,000 USD at the time, to recover its files. And these are just the cases we're hearing about. The scam is so effective that it seemed that the FBI was recommending that victims actually pay the ransom. But it turned out their answer was actually more nuanced. "The official answer is the FBI does not advise on whether or not people should pay," Sean Sullivan, F-Secure Security Advisor, writes. "But if victims haven’t taken precautions… then paying is the only remaining alternative to recover files." What sort of precautions? For Mikko, the answer obvious. "Backups. If you get hit you restore yesterday’s backup and carry on working. It could be more cumbersome if it’s not just one workstation, if your whole network gets hit. But of course you should always have good, up to date, offline backups. And 'offline' is the key!" What's also obvious is that too few people are prepared when Ransomware hits. Barring any disruptions to the Bitcoin market, F-Secure Labs predicts this threat will likely persist, with even more targeted efforts designed to elicit even greater sums. If you end up in an unfortunate situation when your files are held hostage, remember that you're dealing with someone who thinks of cybercrime as a business. So you can always try to negotiate. What else do you have to lose?
F2P can cost parents thousands of Euros – read this to avoid it
This is really an old problem, but it’s in the headlines again. Pokémon Go is yet another example of a “free” game with a business model based on in-app purchases. These games are also known as F2P, standing for free-to-play. You can start playing, and get hooked, for free. But soon you run into a situation where you can’t proceed without buying virtual stuff in the game. The stuff you buy is virtual but the payment is very real money. This is no doubt a profitable model. Pokémon Go went straight to the top and for example Finland-based Supercell, maker of Clash of Clans, has constantly reported nice profits. This can naturally cause trouble for addicted adults, but the real problems arise when kids get hooked. There are numerous public stories about kids making purchases for hundreds or even thousands of Euros, often without even understanding how much they have spent. And the sinister part is that this can go on for a while until you get the credit card bill, and it’s too late. Your chances to get a refund are somewhere between slim and none. But how can this happen? Let’s take a look at the most common scenarios. Your kid has set up the new device and created the needed account with Apple or Google. Everything is fine until he or she needs an app that isn’t free. You enter your credit card on the kid’s device and make the purchase, but you don’t pay any attention to the security settings. This may give your kid carte blanche to buy anything he or she likes, and you pay the bill. You have entered your credit card but set up the kid’s store account so that a password only you know is required for every purchase. But there are some convenient settings that allow purchases without a password within a limited time window after the password has been entered. Kids learn very quickly to utilize this opportunity. Let’s assume the same setup as in the previous point, but with the correct security settings. Now the password is needed for every purchase. But the store account is still owned by the kid and the password can be reset. The password reset link will be sent to the kid’s mail or phone number. It’s carte blanche again with the new password. Ok, you create an account you own for the kids phone. It’s tied to your mail and phone number, so the password reset trick shouldn’t work anymore. You put down your phone and head for the toilet. Your kid has been waiting for the opportunity and initiates the password reset request. Your phone is there on the table wide open, with the reset link in the mail. You can figure out the rest yourself. And of course the simple alternative. You think the store password on your kid’s device is secret. But in reality it is either too easy to guess or someone has been looking over your shoulder. So there’s many things that can go wrong, but what can we do to avoid it? There are many ways to fight this problem, but this is in my opinion the best approach: Let the kid set up the store account on the device and set own passwords. Just like an adult would use a phone, except that there’s no payment method registered. Never enter your credit card number on the kid’s device. On Android, get familiar with Google Play Family. This feature enables you to purchase stuff for your kid on your own device. On iPhone, send apps or money as gifts. There may be applications that bypass the store and handle credit card transactions directly. This can typically be handled with vouchers or other prepaid payment methods instead. The application usually guides the users and list all supported methods. Let’s also take a look at the hard way. Follow these instructions if you for some reasons must have your credit card registered as a payment method on the kid’s device. Make sure the store is protected with a good password that only you know. Make sure the kid isn’t watching too closely when you enter it. Make sure the store is set up to require the password every time a purchase is made. Make sure the store account is attached to an e-mail only you have access to. Make sure the e-mail password is decent and not known to your kid. Make sure your phone’s security settings are decent. Use a PIN or password your kid doesn’t know and make sure it locks automatically quickly enough. Even better, do not have the e-mail of your kids store account on your phone. Access it through web mail when needed. So this is after all a quite complex issue. There are many variations and other ways to deal with the problem. Did I miss some simple and clever way? Write a comment if you think I did. And finally. Yes, there’s also many ways to lock the kids out of the store completely. This does no doubt solve some problems, but I don’t think it’s a good idea. They will after all live their lives in a world where digital devices and services are as natural as breathing. They deserve the opportunity to start practicing for that right now. Let them browse the store and discover all the fun stuff. And be part of the group and use all the same apps as their friends. Let them have fun with the phone and learn, even if they will learn some things the hard way. Don’t ruin it for them. Safe surfing, Micke