Category Archives: Frauds

Don’t save your credit card data in online shops

Online shops such as Amazon and eBay track many different types of metrics, one of the most important being “conversion rate”. This means how many of their visitors end up buying a product from the website.

They’ve discovered you can increase the conversion rate by remembering a costumer’s payment data.

From a cybersecurity standpoint however this is risky business, since if the online shop gets hacked, then they might reveal a huge amount of stored credit card data, including yours.

Mortgage Relief Scam


Behind on your mortgage and looking for help? Check out these tips and learn how to avoid mortgage relief scams.

If you’re hiring a company to stop foreclosure or reduce your mortgage payments, here are some things to keep in mind:

  • Don’t pay an up-front fee. Unless they’re attorneys following specific rules, it’s illegal for companies to charge you until they’ve negotiated a loan modification and you’ve accepted it. So, don’t pay them until they fulfill their promise.
  • If a company claims attorneys will be helping you, check it out. Make sure they’re licensed to practice law in your state. Some companies falsely claim to be working with attorneys to get your business and charge fees in advance.
  • Beware of companies that tell you to stop contacting your lender. You should always feel free to contact your lender directly to see whether they can offer you additional options. Companies that tell you otherwise are breaking the law.
  • Find free, reliable mortgage assistance. To contact a free, HUD-approved housing counselor, visit the U.S. Department of Housing and Urban Development or HOPE NOW

Source/Reference

New phishing scam targets Netflix customers


Photo
Photo (c) mphillips007 – Getty Images

If you receive an email from Netflix informing you that your credit card no longer works, be very careful how you respond.

Mailguard, an Australian cyber-security firm, is warning that fraudsters are using “brandjacking” emails in hopes of capturing consumers’ credit card information.

Brandjacking is an increasingly common tactic used in phishing scams. The email is designed to look like it’s coming from a well-known institution. It might be a major bank or a utility company.

In this case, the bogus email appears to come from Netflix — a video streaming service with millions of subscribers worldwide — and at first glance the email appears to be the real thing.

Payment declined

PhotoIn bold letters at the top, the email informs the recipient that payment for Netflix services has been declined and that credit card information must be updated.

There is a button to click to update credit card information. But the link takes you to the scammer’s website where you are asked to enter credit card information, which will then be sold on the Dark Web.

This scam is dangerous because so many people who are receiving this email are Netflix customers. Their first response may be to click the button and provide the requested information.

But there is a safer course of action. Should you receive one of these emails, type the Netflix URL into your browser and log into your account. After you’re signed in, click on your personal icon in the upper right corner of the page, then click on “account.” Then click on “update payment info.”

If there is a legitimate problem with your credit card, you’ll see a message there informing you of that fact. If you’re still not sure, you can re-enter your credit card information or enter the information for a different credit card.

Tell-tale clues

A closer look at the email, however, might save you the trouble. If the email mentions that your American Express card was declined, but Netflix uses your Visa, then the email is an obvious fake.

Also note the spelling of certain words. Emails sent to customers in the U.S. should refer to the “Help Center,” not the “Help Centre.”

Phishing scams can take different forms. Besides directing a potential victim to a phony website, they can also contain attachments that can unleash malware, including ransomware.

Source/Reference

Say NO to websites which try to install stuff on your device

If you’re on a website that tries to asks you to install something in order to run properly or for any other reason, leave it immediately!

Here are two examples of what you may come across while you surf the web:

Ask yourself this: why would a website need to install something for you to access it?

The best thing to do is to ignore all the download options that come your way. You should be the one to choose which software you want to install, when to install it and why to install it.

Vishing, is like phishing, except they call you

Vishing is a social scamming method similar to phishing, except that scammers will try to trick the victim through a telephone call or even an Internet call such as Skype or FaceTime. As in other forms of phishing, the scammers target important personal information such as credit card data, passwords, emails and so on.

Voice phishing is the criminal practice of using social engineering over the telephone system to gain access to private personal and financial information from the public for the purpose of financial reward. It is sometimes referred to as ‘vishing‘, a word that is a combination of “voice” and phishing.

How scammers make you pay

Here’s one of the top questions we get from people: Is this a scam? Whatever the “this” looks like, here’s our best answer to that question: Did someone say you can only pay by wiring money, putting money on a gift card, or loading money on a cash reload card? If they did, then yes: that is a scam.

Here’s a video that has, in a little more than a minute, some of the scam scenarios we see – and what you should do about them.

Whether someone tells you to pay to claim a prize, help someone out of trouble, or deal with tax issues from the (so-called) IRS: nobody legitimate is ever going to say you have to pay by wiring them money, getting iTunes cards, or putting money on a MoneyPak, Vanilla Reload, or Reloadit card.

So: watch the video. And if anyone ever insists you pay in one of those ways, tell the FTC. Because that will be a scam we want to know about.

Source

Careful when clicking Accept (Adware)

The truth is that no one reads the Terms and Conditions. We just scroll and click “Accept”, so we can get to the point where we can use the apps we install and do what we need to do.

However, when using new software whose trustworthiness you’re unsure of, it’s best to at least glance over the terms and conditions before clicking “I agree” or “Accept”.

Online crooks sometimes slip adware into otherwise safe software installers, and they bury it in the fine print of the terms and conditions. Since no one reads it, users unknowingly install adware that can potentially open up their systems to other cyber threats.

So please only install software from trusted sources and be careful of what it can hide.

Easy money scam

Would you pay $49 for a “secret code” to make huge sums of money automatically? That’s what the FTC says the fraudsters behind the Mobile Money Code scam promised. In fact, the FTC alleges that the defendants and their affiliate marketers were out to rip people off.

In a case announced today, the FTC says the defendants took more than $7 million and provided nothing more than software products that showed people how to create a mobile-friendly website.

The FTC says that the defendants paid a network of affiliate marketers to drive people to its websites. These affiliates used spam emails to push false claims and deceptive marketing. According to the FTC, they included:

  • Fake testimonials — “real life” rags to riches stories… that were really from paid actors
  • Outrageous claims — “You can make $1,000 to $5,000 a day just by having this app running in the background”
  • High-pressure upselling — for more money you could have a “ready to go” business worth over $250,000
  • Subject lines like “In transit: Payment into your account”
  • “Hassle-free” money-back guarantees they did not honor

If someone promises you fast and easy money, it’s a scam. Do you feel yourself wanting to believe it? Watch out! That’s a normal reaction scammers count on. Do not take the bait. Slow down. Search the company’s name online with words like “scam” or “complaint.” Talk to a friend, and help others by reporting what you’ve spotted to FTC.gov/complaint.

Top Ten Cyber Security Predictions

1. The Internet of Things

The First Major Attack on IoT Devices​ 2016 was the breakout year for attacks on IoT devices. In October, the first massive cyber attack involving IoT devices, such as​ ​webcams and DVRs, occurred. The ​Mirai Botnet was unleashed, and it took down half the Internet in the United States ​for hours. Using what is called a Distributed Denial of Service (DDoS) attack, cybercriminals flooded one of the largest server companies in the world with massive amounts of traffic, bringing down the servers and websites hosted on them. It was discovered that tens of millions of computers were sending data to targeted websites, simultaneously. Shortly after the U.S. attack, the same botnet attacked Germany, disrupting services for over 900,000 Internet subscribers.

​This particular strain of malware is not going away anytime soon. The malware itself is believed to be widely distributed on the black market, and hackers are offering established botnet armies for hire. The big surprise for users involved in this attack was realizing that connected devices have default usernames and passwords.

Because of this fact, the attackers targeted certain devices that for which they had obtained the default usernames and passwords.This threat is likely to continue given the increasing popularity of connected devices, but there are ways you can protect yourself. IoT devices, no matter how small they seem, are computers too! Do some research on your device to see if it has a default password. If it does, the manufacturer’s website should have instructions on how to change it.

A new security solution for IoT vulnerabilities​

Over the past year, here at Norton, we’ve been keeping a close eye on the Internet of things threat landscape. As a result, we’re proud to announce the brand new Norton Core router.

Unlike conventional routers, Norton Core was built to secure and protect connected homes. To provide strong wireless coverage, Norton Core has a unique antenna array inside a geodesic dome of interlocking faces, inspired by defense and weather radars deployed in the extreme reaches of the globe. Norton Core’s unique mathematical design encourages users to place it out in the open, as part of their home décor, providing a strong, unobstructed Wi-Fi signal.

IoT Ransomware

In addition to the Mirai Botnet targeting IoT devices, we also saw a new ransomware threat that affected smart TVs. FLocker (short for “Frantic Locker”) ransomware was capable of locking up an Android-based television. This particular ransomware strain is not new, as it has been posing a threat to Android smartphones since May of 2015. However, this particular strain made the jump to smart TVs running android OS in 2016. Luckily, this variant of malware does not encrypt files on the infected television. However, it does lock the screen, preventing the user from watching TV.

The continued targeting of smart devices by cybercriminals is our top threat prediction for 2017. With all these new attacks starting to ramp up in late 2016, we can only expect to see more of attacks on these devices in 2017.

2. The Apple Threat Landscape

The Apple threat landscape was extremely busy in 2016. We reported on seven major stories in 2016. In 2015, we saw quite a few proof of concepts, but 2016 brought more threats out into the wild. These are the same threats that are affecting Windows and Android devices.

Fake Apps Do Exist for iPhones

Cybercriminals sneaked fake shopping apps into the app store right before the holiday season. While Apple has a rigorous vetting process for their apps, these scammers got tricky and updated the apps with malware after Apple approved them for the App Store.

Spyware Is Everywhere

In addition to fake apps, 2016 saw the first targeted spyware released in the wild for iOS. Researchers discovered that a highly sophisticated cyber espionage group deployed a very rare, advanced form of spyware, which can break an iPhone wide open. The spyware, known as Pegasus, is distributed by sending a link to a malicious website via text message. The good news: Apple has already pushed out the update to the vulnerability.

iOS Bugs Are Ramping Up

Also on the iOS platform, there were three major vulnerabilities to keep an eye on. Researchers discovered a way to break the encryption used by iMessage that could allow attackers to access and steal attachments such as images, videos and documents that are being shared securely with contacts.

The second vulnerability discovered involves the handling of PDF documents. An attacker could send you a booby-trapped PDF that would then cause malicious code to run on your iPhone.

The third involves the fix of a three-year old cookie theft bug. Cookies are small files that contain various types of data that remember a user, and are placed on your computer or mobile device by websites you visit. This flaw can allow hackers to impersonate users and steal sensitive information by creating a malicious public Wi-Fi network. The hackers then wait for a compromised user to join the network and redirect them to a malicious website designed to steal user credentials. From there, the hacker would be able to open the embedded browser screen you would see when joining a public Wi-Fi network, load content into a user’s phone and execute it without them knowing.

Mac Ransomware–It’s Happening!

In March of 2016 Apple customers were the targets of the first Mac-focused ransomware campaign executed by cybercriminals. In this instance, it was the first time that cybercriminals used malware to execute real-life attacks.

In this particular case, users were downloading a program called “Transmission for BitTorrent,” which is used for peer-to-peer file sharing. Users downloaded a “bad” version of the installer for the software, which contained a malicious Trojan horse, known as OSX.Keranger. A Trojan horse is malicious software that can wreak havoc with data in many ways–such as the deletion, modification, copying, and stealing of data–as well as implant ransomware on the device. Like most ransomware, will encrypt a user’s files and demand a fee to release them.

Not Just Macs and iPhones Anymore

2016 also brought the first major issue to Apple’s AirPort routers. Apple discovered vulnerabilities in the firmware of AirPorts that could allow attackers to execute commands on the affected devices and infiltrate home networks. If your AirPort is flashing yellow, go update your firmware now!

This just goes to show that Apple products do need security software, now more than ever. You can protect your Mac against these threats and more with Norton Security Premium.

3. Man in the Middle Attacks

2016 was also a big year for Man-in-the-Middle (MitM) attacks. An MitM attack employs the use of an unsecured or poorly secured, usually public, Wi-Fi router. The hacker scans the router using special code looking for certain weaknesses such as default or poor password use. Once a vulnerability is discovered, the attacker will then insert themself in between the users’ computer and the websites the user visits to intercept the messages being transmitted between the two.

A lot of these attacks take place on public Wi-Fi hotspots. Since most of these networks are unsecured, it’s easy pickings for cybercriminals. In addition to unsecured hotspots, hackers will also set up legitimate-looking Wi-Fi networks in order to lure unsuspecting users to connect and give them full access to their device.

Norton WiFi Privacy is a VPN that encrypts all the information sent and received by your mobile device while you’re on public Wi-Fi, making your public connection private. Download Norton WiFi Privacy now.

4. Android, Android, Android!

In 2016, we reported on six major Android events. The top three threats we saw involved fake apps, botnets, and, of course, ransomware.

Bad Apps

Hundreds of malicious applications showed up on the Google Play store in October, disguised as legitimate applications. These malicious apps were carrying malware known as Dresscode. Dresscode is designed to infiltrate networks and steal data. It can also add infected devices to botnets, which carry out denial-of-service (DDoS) attacks as well as take part in spam email campaigns.

Android Botnets

Android smartphone users should be aware of a dangerous new type of malware that spreads via spam SMS or MMS messages.  The Mazar BOT, as it is called, tricks the Android user into providing administrative access to the infected Android phone and can then erase any stored data. Although security research experts believe this malware has several hidden capabilities that are still being discovered, they know this malware will turn your smartphone into part of a hacker botnet web.

Mobile Ransomware

In 2016 there was a lot of mobile ransomware rampant on the threat landscape. Most notably, there were two that left devices completely vulnerable.

One variant of Android ransomware uses what is called “clickjacking” tactics to try and trick users into giving the malware device administrator rights. Clickjacking occurs when attackers conceal hyperlinks beneath legitimate content, tricking the user into performing actions of which they are unaware. Users stumble upon these illegitimate links, assuming that when they fill out a field, click on a link, or type in their passwords they’re gaining access to what they see in front of them.

Android.Lockdroid was spotted on March 11, 2016, and disguised itself as a system update. What’s different about this particular strain is that once the ransomware detects that it’s installed on a device in a certain country, it displays the ransom message in that country’s language. This is the first type of “chameleon” ransomware we’ve spotted. In general, Android.Lockdroid needs to be manually downloaded by the user from adult sites to infect devices. It could also automatically arrive on the device when the user clicks on advertising links, which is known as malvertising, a form of malicious advertising.

Taking advantage of quality security software such as Norton Mobile Security, (link is external) is an important measure that protects your device from malicious apps. With Norton Mobile Security, you can use our app advisor to scan for “bad apps” before downloading them to your phone. Norton App Advisor is a special feature included with Norton Mobile Security. It warns of privacy risks, intrusive behavior of apps, excessive battery drainage and data plan usage. It also features call and SMS blocking, anti-theft, contacts backup and protects your mobile phone from malware.

5. Malicious Sites, Drive-by-Downloads and Malvertising

Malvertising is a combined term for malicious advertising, and uses legitimate online advertising services to spread malware. Malvertising requires placing malware-infected advertisements on regular Web pages through authentic online advertising networks in order to infect a device through the Web browser. Malvertising can affect ANY device–PC, Mac, Android, etc.

In March of 2016 several mainstream websites fell victim to a massive malvertising campaign. The tainted ads in these websites directed thousands of unsuspecting users to a landing page hosting the notorious Angler Exploit Kit, a kit that stealthily installs crypto-ransomware.

Malicious Websites and Drive-by-Downloads

A drive-by-download is a download that occurs when a user visits a malicious website that is hosting an exploit kit. There is no interaction needed on the user’s part other than visiting the infected webpage. The exploit kit will look for a vulnerability in the software of the browser and inject malware via the security hole. Symantec identified thousands of websites in 2016 that had been compromised with malicious code. Of the compromised websites, 75 percent were located in the U.S.

Defensive software such as Norton Security will prevent known drive-by downloads and warn you when you try to visit a malicious website.

If you are unsure about the credibility of a website you can also use Norton Safe Web, a free online tool, that can help identify risky websites as you browse the Web.

6. Social Media Scams

In 2016, Facebook reported that it had 1.71 billion monthly active Facebook users. Twitter has 313 million monthly active users. With so many active users, popular social sites are a scammer’s paradise. The motives are the same: scammers try to exploit these stories for any kind of financial gain possible.

Scammers will try to entice you into clicking by posting sensational or emotional breaking news stories, sometimes capitalizing on a recent news event, or making up a fake, shocking news story. When you click on the link, you get a notification that you need to download a plug-in in order to view the video. Click on it and you could be downloading spyware that will stay on your device and collect personal information that could be used for identity theft. Remember to delete emails from unknown senders and don’t download unknown plug-ins.

7. Tax Scams and Identity Theft

It’s important to realize that tax documents contain a plethora of personally identifiable information about people, such as wage information, Social Security numbers, home addresses and place of employment. Once these documents are obtained, the criminals would have everything they need to perform tax refund fraud; effectively stealing tax refunds owed to others. Because these documents contain a plethora of information, they can help the scammers commit identity fraud In addition to tax refund fraud.

Examples of phishing emails to be on the lookout for:

  • Fake IRS and TurboTax emails claiming the recipient’s tax refund is restricted or their account has been locked
  • Fake IRS-branded emails asking the recipient to update their tax filing information
  • Fake email claims saying a tax payment was deducted and includes a “receipt”
  • Fake email from the IRS seeking proof of identity documents because “You are eligible to receive a refund”
  • W2 phishing emails targeting employees

Existing Trends Coming Back for More

8. Ransomware:

Ransomware is here to stay. The first known case of ransomware popped up in 2013, and hackers have latched on to this tactic, refining it over the years. In 2016 we reported on eight major ransomware campaigns, which affected everything: Macs, Windows computers, Android platforms and more.

This year, we saw some notably new forms of ransomware, which just goes to show that cybercriminals are trying to “up their game” in extorting money from you.

The most unique form of ransomware we saw was the Jigsaw ransomware. This is not your average ransomware. Like other ransomware, Jigsaw will encrypt your files and demand a ransom in order to retrieve your files; however, it also comes with a countdown timer. During the first 24 hours it will start deleting a few files every hour. On the second day, the ransomware will delete hundreds of files, on the third day it will delete thousands–until the ransom is paid. Additionally, if you try to tamper with the ransomware or even restart your computer, it will delete 1,000 files as a “punishment.

”Whatever happens in ANY case of ransomware, do NOT pay the ransom, and be sure to keep regular backups to help protect your data in case you become a victim of ransomware.

Need backup? Norton Security Premium offers you an easy way to help defend against ransomware as well as a convenient backup solution.

9. Software Vulnerabilities and Software Updates:

Major software vulnerabilities continued to be a huge problem in 2016. Attackers heavily rely upon these vulnerabilities, as it is the easiest way to sneak malware into a user’s device unnoticed, with little action on the user’s part.

We reported on six major vulnerabilities in 2016- including an Adobe patch for 25 flaws, as well as quite a few other emergency patches from them as well.

The best way to combat against these attacks is to perform any and all software updates as soon as they are available. Software updates will patch those security holes attackers exploit, add new features and improve bug fixes.

10. 2016 Was a Banner Year for Mega Data Breaches

​Unfortunately, data breaches are almost as common as malware outbreaks. In 2016 there were eight mega-breaches involving major companies. Most recently, in December, over 1 million Google accounts were breached via malicious Android apps. This attack was particularly nasty because the only way to completely remove this malware from an infected device is to do a clean installation of the operating system. This is a complicated process, but mobile carriers can perform the installation for users.

However, topping the list for the most accounts breached was Yahoo, with a whopping total of 1.5 billion users. Yahoo announced this year that they had been the victim of two separate cyber attacks that occurred in 2014. The first breach that was announced stole information associated with 500 million accounts. The second breach, which is now the largest data breach in history, stole information from one billion accounts.

The second largest data breach of 2016 was from FriendFinder Networks Inc., which involved a breach of over 400 million accounts. 117 million LinkedIn user credentials were also snagged in 2016, and Dropbox verified that 68 million credentials were also stolen last year.

Big data is big money for attackers, so they set their sights on companies that tend to hold large amounts of personally identifiable data on their customers, such as Social Security numbers, birthdates, home addresses and even medical records. It’s easy for a cybercrime victim to report credit card fraud and just get a new number. When it comes to a Social Security number, though, you are bound to it for life. And Social Security numbers open the door to all sorts of identity theft.

Source/Reference

5 Bad online habits you need to break

Here are 5 bad online habits you need to quit:

1. Allowing your browser to remember passwords.

2. Reusing passwords.

3. Relying on a free antivirus alone to protect you from all cyber threats.

4. Not updating your apps and operating system when a new update is launched. (This is true for all your devices.)

5. Thinking you have nothing to hide or to lose if cybercriminals do compromise your devices and data.

If you still find yourself guilty of these cyber security “sins”, it’s time to confess it to yourself and do whatever you can to change them. Maybe not all at once, but at least trying will help you improve your security vastly.