Category Archives: Cyber

5 Bad online habits you need to break

Here are 5 bad online habits you need to quit:

1. Allowing your browser to remember passwords.

2. Reusing passwords.

3. Relying on a free antivirus alone to protect you from all cyber threats.

4. Not updating your apps and operating system when a new update is launched. (This is true for all your devices.)

5. Thinking you have nothing to hide or to lose if cybercriminals do compromise your devices and data.

If you still find yourself guilty of these cyber security “sins”, it’s time to confess it to yourself and do whatever you can to change them. Maybe not all at once, but at least trying will help you improve your security vastly.

Important things you need to know about phishing

Phishing is when an attacker misuses technology to trick someone into divulging sensitive information, such as usernames and passwords or credit card numbers. People often associate phishing with fraudulent email messages—think Nigerian prince scams—but
phishing also reaches victims through web pages, documents, text messages, social media content, instant messaging, advertisements, and even phone calls.
  •  A phishing website lives, on average, for 15 hours. Cybercriminals take phishing websites down quickly so authorities can’t track them down.
  • Attackers use safe websites to hide their phishing websites to keep their operations going.
  • In 2016, cyber security researchers have found over 400,000 phishing websites each month! That’s almost 5 million phishing websites in a year!
  • Cybercriminals impersonated Google, PayPal, Yahoo and Apple the most this year, using them to manipulate users and trick them into revealing their confidential information.
Despite its humble beginnings, phishing has come a long way
since those first crudely constructed phishing emails. The
following are the most important findings from this report:
Strengthening an organization’s anti-phishing strategy means
moving beyond old techniques that use static phishing
domain or URL lists to highly automated technologies based
on sophisticated machine learning methods. These more
advanced technologies can quickly check the characteristics
and metadata for each requested webpage to look for signs of
phishing, then report a score or rating that the organization can
use to make automated decisions about allowing or denying
access to the page. When phishing sites can appear and
disappear in the length of a coffee break, highly automated
machine learning solutions are the only way to prevent
successful phishing attacks and the major data breaches they
facilitate.

Computer Security | Consumer Information

Scammers, hackers and identity thieves are looking to steal your personal information – and your money. But there are steps you can take to protect yourself, like keeping your computer software up-to-date and giving out your personal information only when you have good reason.

Update Your Software. Keep your software – including your operating system, the web browsers you use to connect to the Internet, and your apps – up to date to protect against the latest threats. Most software can update automatically, so make sure to set yours to do so.

Outdated software is easier for criminals to break into. If you think you have a virus or bad software on your computer, check out how to detect and get rid of malware.

Protect Your Personal Information. Don’t hand it out to just anyone. Your Social Security number, credit card numbers, and bank and utility account numbers can be used to steal your money or open new accounts in your name. So every time you are asked for your personal information – whether in a web form, an email, a text, or a phone message – think about why someone needs it and whether you can really trust the request.

In an effort to steal your information, scammers will do everything they can to appear trustworthy. Learn more about scammers who phish for your personal information.

Protect Your Passwords. Here are a few ideas for creating strong passwords and keeping them safe:

  • Use at least 10 characters; 12 is ideal for most home users.
  • Try to be unpredictable – don’t use names, dates, or common words. Mix numbers, symbols, and capital letters into the middle of your password, not at the beginning or end.
  • Don’t use the same password for many accounts. If it’s stolen from you – or from one of the companies where you do business – thieves can use it to take over all your accounts.
  • Don’t share passwords on the phone, in texts or by email. Legitimate companies will not ask you for your password.
  •  If you write down a password, keep it locked up, out of plain sight.

Consider Turning On Two-Factor Authentication. For accounts that support it, two-factor authentication requires both your password and an additional piece of information to log in to your account. The second piece could be a code sent to your phone, or a random number generated by an app or a token. This protects your account even if your password is compromised.

Give Personal Information Over Encrypted Websites Only. If you’re shopping or banking online, stick to sites that use encryption to protect your information as it travels from your computer to their server. To determine if a website is encrypted, look for https at the beginning of the web address. That means the site is secure.

Back Up Your Files. No system is completely secure. Copy your files to an external hard drive or cloud storage. If your computer is attacked by malware, you’ll still have access to your files.

Reference

3,1 billion data records leaked in 2016. How do you protect yourself?

In 2015, data breaches caused for 480 million data records to be leaked, breached or otherwise exploited by cyber criminals. But that figure doesn’t even compare to the astounding statistic from 2016.

With 3.1 BILLION data records breached in 2016, chances are high that your own data was involved in one of the massive breaches of the year.

let’s walk through some of the major hacks and data breaches from the past couple of years, and how they impacted the users:
1. Ashley Madison – August 2015 – 37 million people that were using the Ashley Madison site had their data published online, including credit card and sexual preferences. The service encouraged extramarital affairs, by helping users cheat on their partners. It led to many divorces and even some suicides.
2. iCloud / Apple – September 2014 – Not even cloud storage is safe from data breaches. Hundreds of nude celebrity photos leaked online, in a hack that was dubbed “The Fappening”. Apple later reported that the data was obtained using a highly targeted attack on user names, passwords and security questions.
3. Sony Pictures Entertainment – November 2014 – You most likely remember the Sony hack, that was allegedly planned by North Korea. 47.000 social security numbers of Sony employees were taken by attackers, plus names, address and financial information. However, the press mainly focused on the gossip side of the hack. The published stories covered the private conversations between Hollywood actors and movie industry players that also leaked.
4. Snapchat / SnapSaved – October 2014 – Also known as the Snappening, in reference to the Fappening, more than 13 GB of Snapchat videos and photos leaked online. The files were breached via a third-party app, SnapSaved, that was used to save and access Snapchat files.
5. IRS – May 2015 – More than 330.000 taxpayers were affected in this data breach. It may seem like a small number, compared to other data breaches, but the impact was disastrous. The attackers gained access to filed tax returns, financial information and social security numbers.
6. Vtech – November 2015 – Information on 6.4 million children and 5.9 million adults were exposed in what experts consider the largest theft of personal data targeting kids. Name, gender and birthdate were among the stolen data on the kids, while parents had their name, mailing address, secret question and answer for password retrieval, IP address, download history and encrypted password leaked. We don’t even want to imagine what could happen if some ill-intentioned individuals would pair the info on the parents and their children.
7. LastPass – June 2015 – Who says password manager services are safe? LastPass servers were attacked last summer. The data accessed by the intruders included email addresses, password reminders and authentication hashes. However, encrypted user data (aka your stored passwords) was not breached. The company prompted all the users to update their master password immediately.
8. eBay – May 2014 – One of the biggest data breaches of all times, that let 145 million users with their names, email and postal addresses, phone numbers, birthdates and encrypted passwords exposed.
9. Anthem – February 2015 – A data breach of the second biggest health insurer in America exposed medical information of 80 million customers. Plus names, birthdays, social security numbers, email and home addresses.
10. Spotify – November 2014 – Not even music streaming services are safe from attackers. Last year, over a thousand Spotify users had their email addresses and passwords leaked online. Gaana, the most popular indian music streaming service, with more than 7.5 million monthly users, also got hacked and had its database exposed.

Source

Ransomware can now encrypt your smart TV too

Ransomware keep evolving and can now encrypt smart TVs.

According to the software developer, when he first contacted LG’s tech support, he was told that a technician would have to come over and take a look for a fee of around $340.

The ransom amount itself was $500 although even paying that would have been difficult because there was no way to click on the payment section to find the instructions on how to do so. The only thing that worked was just moving a mouse-like pointer on a portion of the TV screen via an accompanying smart remote.

In order to keep your smart TV safe, avoid downloading strange apps (even if they are in the Google Play store), keep your software up to date and protect your home Wi-fi.

Top 10 Tips To Stay Safe Online


With hacks, scams, malware and more, the Internet can feel like a dangerous place these days. And, the recent proliferation of devices, from smartphones and tablets to Internet-connected appliances, has opened us up to even greater risks.

But the good news is that by taking just a small handful of security measures we can greatly reduce our exposure to all these threats.

Here are some tips to help you get started:

1. Create Complex Passwords. We know you’ve heard it before, but creating strong, unique passwords for all your critical accounts really is the best way to keep your personal and financial information safe. This is especially true in the era of widespread corporate hacks, where one database breach can reveal tens of thousands of user passwords. If you reuse your passwords, a hacker can take the leaked data from one attack and use it to login to your other accounts. Our best advice: use a password manager to help you store and create strong passwords for all of your accounts.

Then, check to see if your online accounts offer multi-factor authentication. This is when multiple pieces of information are required to verify your identity. So, to log into an account you may need to enter a code that is sent to your phone, as well as your password and passphrase.

2. Boost Your Network Security. Now that your logins are safer, make sure that your connections are secure. When at home or work, you probably use a password-protected router that encrypts your data. But, when you’re on the road, you might be tempted to use free, public Wi-Fi.The problem with public Wi-Fi is that it is often unsecured. This means it’s relatively easy for a hacker to access your device or information. That’s why you should consider investing in a Virtual Private Network (VPN). A VPN is a piece of software that creates a secure connection over the internet, so you can safely connect from anywhere.

3. Use a Firewall. Even if your network is secure, you should still use a firewall. This an electronic barrier that blocks unauthorized access to your computers and devices, and is often included with comprehensive security software. Using a firewall ensures that all of the devices connected to your network are secured, including Internet of Things (IoT) devices like smart thermostats and webcams. This is important since many IoT devices aren’t equipped with security measures, giving hackers a vulnerable point of entry to your entire network.

4. Click Smart. Now that you’ve put smart tech measures into place, make sure that you don’t invite danger with careless clicking. Many of today’s online threats are based on phishing or social engineering. This is when you are tricked into revealing personal or sensitive information for fraudulent purposes. Spam emails, phony “free” offers, click bait, online quizzes and more all use these tactics to entice you to click on dangerous links or give up your personal information. Always be wary of offers that sound too good to be true, or ask for too much information.

5. Be a Selective Sharer. These days, there are a lot of opportunities to share our personal information online. Just be cautious about what you share, particularly when it comes to your identity information. This can potentially be used to impersonate you, or guess your passwords and logins.

6. Protect Your Mobile Life. Our mobile devices can be just as vulnerable to online threats as our laptops. In fact, mobile devices face new risks, such as risky apps and dangerous links sent by text message. Be careful where you click, don’t respond to messages from strangers, and only download apps from official app stores after reading other users’ reviews first. Make sure that your security software is enabled on your mobile, just like your computers and other devices.

7. Practice Safe Surfing & Shopping. When shopping online, or visiting websites for online banking or other sensitive transactions, always make sure that the site’s address starts with “https”, instead of just “http”, and has a padlock icon in the URL field. This indicates that the website is secure and uses encryption to scramble your data so it can’t be intercepted by others. Also, be on the lookout for websites that have misspellings or bad grammar in their addresses. They could be copycats of legitimate websites. Use a safe search tool such as McAfee SiteAdvisor to steer clear of risky sites.

8. Keep up to date. Keep all your software updated so you have the latest security patches. Turn on automatic updates so you don’t have to think about it, and make sure that your security software is set to run regular scans.

9. Lookout for the latest scams. Online threats are evolving all the time, so make sure you know what to look out for. Currently, ransomwareis on the rise. This is when a hacker threatens to lock you out of all of your files unless you agree to pay a ransom. Stay on top of this and other threats by staying informed.

10. Keep your guard up. Always be cautious about what you do online, which sites you visit, and what you share. Use comprehensive security software, and make sure to backup your data on a regular basis in case something goes wrong. By taking preventative measures, you can save yourself from headaches later on.

Reference

Why keeping your OS up to date

They say Macs are safer than Windows PCs, but Apple’s devices have their own share of vulnerabilities that can be exploited by hackers to seize full control of the systems.

If you’re still unsure of why you should update your operating system to the latest version, here’s a true story I hope will persuade you why it’s the right thing to do.

A Swedish security expert showed how a $300 device can steal passwords from sleeping or closed Macs (the same which most people think are impenetrable to cyberattacks).

“Anyone including, but not limited to, your colleagues, the police, the evil maid and the thief will have full access to your data as long as they can gain physical access – unless the mac is completely shut down. If the mac is sleeping it is still vulnerable. Just stroll up to a locked mac, plug in the Thunderbolt device, force a reboot (ctrl+cmd+power) and wait for the password to be displayed in less than 30 seconds!”

Apple fixed this vulnerability in macOS 10.12.2, so that’s why applying these updates is key for your cyber security. Of course, the same goes for Windows, even more so than for Mac OS X.

Beware of fake delivery notifications (emails)

Cybercriminals have been using fake delivery notification emails to spread malware for many years now. In spite of their history and frequency, this attack tactic still works.

Some of the reasons include lack of proper security measures taken by the companies you purchase things from, but also emotions clouding people’s judgement when prompted by such an alert.

[why%20so%20many%20people%20fall%20for%20the%20fake%20delivery%20notifications?]You can see an example here and read the words of an experienced malware researcher on the topic.

Be very, very careful when receiving and reviewing delivery notifications, as they’re very effective for spreading the worst kind of malware, including financial malware and ransomware.

Online Shopping Safety Tips

Using Public Wi-fi

“If you are shopping on your phone or computer and using an unknown WiFi connection, save the purchases for later. Don’t enter any personal information such as name, address, or credit card number until you are on a secure and known connection.” – Loki Labs, www.lokilabs.io

Visiting a New Website

“Check the seller’s customer satisfaction ratings. Review other user’s comments and check out the seller’s rating on sites like Google Shopping. Low “star” ratings may provide a red flag that cautions you to find a more reputable seller.” – Diverse Concepts, www.dciits.com“Check the Better Business Bureau website to see if there are a large number of complaints about the seller. https://www.bbb.org/greater-maryland/” – Diverse Concepts, www.dciits.com

“Go directly to the seller’s site rather than clicking a “coupon” link that was sent to you by an unknown source. Scammers can often use a tactic called cross-site scripting to craft a hyperlink that appears to be the actual merchant site but actually relays your credit card information to the scammer when you put your payment information into the payment web form. Unless you can verify that a coupon came from the actual vendor’s site to which you have already subscribed, it’s best to avoid random coupons with unknown origins.” – Diverse Concepts, www.dciits.com

“Find out the seller’s physical address. If the merchant only has a P.O. box listed, then that may be a red flag. If his address is 1234 in a van down by the river, you may consider shopping elsewhere.” – Diverse Concepts, www.dciits.com

“Check the seller’s privacy policy. While we might not think about it, some sellers resell our personal information, buying preferences, and other data to market research companies, telemarketers, and spammers. Read carefully and always make sure that you are opting-out and not opting-in when asked whether you want to have your information shared with “3rd parties” (unless you like a lot of spam in your e-mail). You may also want to obtain a separate e-mail account to use while shopping online to avoid clogging up your personal e-mail box with the barrage of sale ads and other junk mail that is frequently sent out.” – Diverse Concepts, www.dciits.com

“If you’re buying something on a new website and they want you to sign up for an account, use a new password. Never use the same passwords for shopping sites as you do for anything else, such as email, bank logins, etc. (It’s a good idea to use a different password for every site you go to but this is especially important.) Even if the company you’re purchasing from is legitimate, you don’t know who might have access to their database now or in the future.” – Loki Labs, www.lokilabs.io

Resources:

FBI Warns of Dramatic Increase in Business E-Mail Scams


FBI officials are warning potential victims of a dramatic rise in the business e-mail compromise scam or “B.E.C.,” a scheme that targets businesses and has resulted in massive financial losses in Phoenix and other cities.

The schemers go to great lengths to spoof company e-mail or use social engineering to assume the identity of the CEO, a company attorney, or trusted vendor. They research employees who manage money and use language specific to the company they are targeting, then they request a wire fraud transfer using dollar amounts that lend legitimacy.

There are various versions of the scams. Victims range from large corporations to tech companies to small businesses to non-profit organizations. Many times, the fraud targets businesses that work with foreign suppliers or regularly perform wire transfer payments.

  • Law enforcement globally has received complaints from victims in every U.S. state and in at least 79 countries.
  • From October 2013 through February 2016, law enforcement received reports from 17,642 victims.
  • This amounted to more than $2.3 billion in losses.
  • Since January 2015, the FBI has seen a 270 percent increase in identified victims and exposed loss.
  • In Arizona the average loss per scam is between $25,000 and $75,000.

If your company has been victimized by a BEC scam:

  • Contact your financial institution immediately
  • Request that they contact the financial institution where the fraudulent transfer was sent
  • File a complaint—regardless of dollar loss—with the IC3.

Tips for Businesses:

  • Be wary of e-mail-only wire transfer requests and requests involving urgency
  • Pick up the phone and verify legitimate business partners.
  • Be cautious of mimicked e-mail addresses
  • Practice multi-level authentication.

Resources: