Authentic8 Blog Author: A8 Team

JavaScript Template Attacks: How Browsers Give Away the Store

Did you know? Attackers use  your locally installed browser base and JavaScript to draw up intricate exploit roadmaps for targeted attacks on your organization. Listen to our interview with security researcher Michael Schwarz to learn how JavaScript template attacks work and how to prevent them.

*

“Free” browsers boast features and extensions that supposedly enhance security and privacy online. The same settings or plugins, it turns out, can be used by adversaries to achieve precisely the opposite effect.

That’s just one of the eye-opening findings reported in the research paper JavaScript Template Attacks: Automatically Inferring Host Information for Targeted Exploits.

The paper was authored by security researchers Michael Schwarz, Florian Lackner and Daniel Gruss of Graz University in Austria. They describe how JavaScript template attacks help attackers prepare pinpointed zero-day or side-channel attacks against large organizations, by exploiting the ubiquitous data leaks in “free” browsers and their extensions.

The researchers found an abundance of environment-dependent properties in Firefox, Chrome, Edge, and mobile

Federal Tech Talk: Secure Web Browsing

You may have heard that browsers were not designed with security in mind. Originally created to make the internet more accessible for scientists, the "free" browser soon morphed into a tool that helped advertisers and marketers turn its users into the product.

The rest is (web) history. In the traditional browser ecosystem, consumers pay for their "free" browser with ad clicks and their online usage data. Inherently insecure browsers have become ubiquitous - even in the federal government and its organizations, where taxpayers expect security to be more than an afterthought.

The high price "free" browsers elicit from federal organizations, in terms of weakened IT security and data protection, was the topic of a recent conversation between John Gilroy, host of Federal News Network's podcast Federal Tech Talk, and Thom Kaye, Federal Program Manager at Authentic8.

One highlight of their insightful exchange on How the browser betrays your organization: Thom explains how location data disclosed by

Interview: SEC Compliance and the Internet

Key Issues for Investment Management Firms

What are the challenges regulated investment management firms are facing when using the internet?

We asked Jane Jarcho, the former Deputy Director of the SEC's Office of Compliance, Inspection, and Examinations (OCIE) and head of the National Investment Adviser and Investment Company Exam program, who recently joined the Promontory Financial Group as a consultant on regulatory and exam issues.

At the OCIE, Jane Jarcho oversaw its program areas, including Investment Adviser/Investment Company (IA/IC), Broker-Dealer and Exchange, FINRA and Securities Industry Oversight, and Clearance and Settlement. Ms. Jarcho also led the IA/IC examination program. Under her leadership, the number of IA/IC examinations increased by more than 100 percent.

The interview was conducted by Chirag Vasavada, Head of Business Operations at Authentic8.

*

Chirag Vasavada: Jane, given your tenure and experience across the SEC's program areas, you're in an ideal position to speak to the challenges faced by regulated entities today. The industry is under

GDPR in the US: After the British Airways Hack

British Airways (BA) announced in September that it had fallen victim to a hack that affected the personal data of 380,000 passengers. The BA hack could be the first prominent test case for the European Union’s General Data Protection Regulation (GDPR) that went into effect in May.

How has GDPR impacted U.S.-based companies so far? Are they prepared for EU regulators cracking down on cross-border data protection failures and privacy violations? The BA attackers exploited a third-party vulnerability in the airline’s digital supply chain, taking a path we recently examined on this blog. What are the lessons to learn from the British Airways data breach?

On our Silo Sessions podcast, Authentic8 Co-founder and CEO Scott Petry discussed these questions as part of his ongoing GDPR conversation with Steve Durbin, Managing Director of the Information Security Forum (ISF).

P.S.: This Silo Sessions episode was recorded before the disclosure of the latest security breach at Facebook, a theft

Interview: Pitfalls of BSA/AML Research on the Web

The pressure on financial services organizations of all sizes to comply with federal Bank Secrecy Act (BSA) and Anti-Money Laundering (AML) regulations is steadily increasing. Banks and investment firms are facing stiff regulatory fines, civil penalties, and industry disbarment for compliance violations.

Industry observers point out that many cases resulting in enforcement action follow a common pattern. Often, the entities found in violation neglected to file Suspicious Activity Reports (SARs) about suspicious transactions.

Then, to make matters worse, during a subsequent investigation they also “failed to promptly produce certain documents” as requested by investigators (PDF).

Online Research as BSA/AML Compliance Bottleneck

Research indicates a direct correlation between the negligence of affected financial institutions to sufficiently investigate, report and document suspicious transactions, and the lack of a compliance-friendly and compliance-ready browsing environment at the disposal of their BSA/AML specialists. Check out the Authentic8 white paper Secure AML Research: Cracking the Efficiency Code (PDF) on this problem and how financial firms are