Hello, welcome to the Thursday, June 2nd, 2016 edition of the Sandcent Storm Center's Stormcast. My name is Johannes Ulrich and I'm recording from Jacksonville, Florida.

Yesterday I mentioned how a lot of bloatware that comes pre-installed on systems suffers from insecure updates now with

bloatware like this we didn't really expect any better but sadly security

software sometimes makes the same mistake the latest one here is key pass

key pass is a free password safe that you can install to manage your password and

it checks for new updates via HTTP and then also downloads the actual software via HTTP.

That's pretty sad also the fact that they will not fix it, according to the individual that found this problem.

According to a response that this individual published from KeyPass, one reason why they are not going to fix this is that they would be losing out on ad revenue and also the cost of implementing HDPS is too much for them.

Well, certificates, you can get them for free and really the overhead involved in HDPS is not

really all that bad.

In particular, if they would implement it just for this download, they could still keep most of the remainder of their page via HTTP, I guess, if they insist in doing so.

Another solution, of course, would be to sign the binary itself and sign these update checks that notify the user that there is a new update available to prevent

tampering with the traffic in transit, but apparently that isn't implemented either.

And this would really not require any changes to their web hosting infrastructure if that

is too complex for them.

And there is quite a bit of talk about a possible compromise of Team Viewer.

Team Viewer is a system that you can use to share your desktop.

A lot of users keep it enabled on their desktop to allow for remote access.

Now over the last few days, several users reported that they had, for

example, money stolen from their banking accounts by having a user log into the system via

team viewer and then use pre-stored logins in their browser to log in their browser to log into various accounts like banking and

PayPal and the like. Now around the same time when this happened, Team Viewer did experience

...