Top Subject People Fall Victim To Is – Data Breach Notification

November 8, 2017 by Joseph Martin

For hackers around the world, success breeds more success, it seems.

A company called KnowBe4 has released a report entitled “Top Ten Global Phishing Email Subject Lines For Q3 2017.” To prepare it, they analyzed email subject lines from simulated phishing tests to determine what the most effective approach was.

Their findings were that “Official Data Breach Notification” was the hands-down winner, generating far more click-throughs than any other.

Perry Carpenter, KnowBe4’s Chief Evangelist, and Strategy Officer had this to say about the report:

“Phishing attacks are responsible for more than 90% of successful cyber-attacks and the level of sophistication hackers are now using makes it nearly impossible for a piece of technology to keep an organization protected against social engineering threats.

We see urgency and fear of a breach as the drivers. We have over 1400 templates and a concentration of themes so we know what is highly effective. Phishing attacks are smart, personalized and timed to match topical news cycles. Businesses have a responsibility to their employees, their shareholders, and their clients to prevent phishing schemes.”

Wise words and the first step on the path to prevention is knowing what triggers are the most effective, which makes the KnowBe4 report especially valuable to data security teams, regardless of what business your company is in.

The irony, however, is inescapable.

The reason that “Official Data Breach Notification” is such a devastatingly effective phishing headline is simply that the hackers have been devastatingly effective. Barely a day goes by that we are not greeted by some grim headline and a news story recounting the woes of yet another company suffering from yet another massive breach resulting in hundreds of thousands, millions, or more consumer data files stolen.

They are, in a very real sense, leveraging the power of their own success to become even more successful, and that’s sadly not likely to change anytime soon.

Ransomware Continues To Evolve On Android Devices

November 6, 2017 by Joseph Martin

Hackers around the world are continuing to innovate at a terrifying, relentless pace, and that truth is reflected in the latest form of ransomware to be found in the wild.

Dubbed “DoubleLocker,” this new strain targets Android devices. It uses and abuses the platform’s Accessibility Service, reactivating itself every time the user presses the phone’s “Home” button.

Initial forensic analysis of the code base reveals this new threat to be based on Svpeng, which is a nasty form of malware that has a rather infamous reputation among Android users. It is one of the best-known banking trojans on the platform, used to steal money from people’s bank accounts, change PINs, brick devices, and demand ransoms to return them to operability.

Although DoubleLocker does not contain Svpeng’s banking hack features, it is a very advanced, highly sophisticated piece of code.

As with so many other malicious programs, it gains an initial foothold on the user’s machine by disguising itself as some other, perfectly legitimate program (most often, Flash Player). Once installed, if the user grants the app access, Android’s Accessibility service allows the app to mimic user screen taps and swipes, allowing it to navigate around on the user’s phone.

It immediately locks the user’s PIN with a ransom PIN code and encrypts all files on the device.

This is the most significant development, because previous to finding DoubleLocker in the wild, most other Android ransomware worked by simply locking the user’s phone. This one takes cues from PC-based ransomware and takes the added step of encrypting the files themselves.

Another intriguing difference is that while most ransomware is configured to send the user an unlock code once the ransom is paid, no such code is sent to a user infected by DoubleLocker. Instead, the hackers unlock the phone remotely, upon receiving payment.

For users impacted by DoubleLocker, the following advice has been offered by ESET:

“The only viable option to clean the device of the DoubleLocker ransomware is via a factory reset.

For rooted devices, however, there is a method to get past the PIN lock without a factory reset. For the method to work the device needed to be in the debugging mode before the ransomware got activated.

If this condition is met, then the user can connect to the device by ADB and remove the system file where the PIN is stored by Android. This operation unlocks the screen so that the user can access their device. Then, working in safe mode, the user can deactivate device admin rights for the malware and uninstall it. In some cases, a reboot is needed. As for data stored on the device, there is no way to recover it, as mentioned earlier.”

3 Reasons Why You Should Be Using Web Filtering

November 6, 2017 by Joseph Martin

1. Security. Imagine an employee visits a website that causes a virus and infects all of your company’s files. Getting those files back would be an absolute nightmare. That’s why you should take a preventative approach and use web filtering. Web filtering protects your company’s data from malware, phishing scams and other various cyber threats. It will block content and websites that could be potentially harmful. In turn, this will reduce the risk of a virus or security breach.

2. Productivity. According to Forbes, 64% of employees are visiting websites that are not related to work. That is money out of your pocket. With web filtering, you can choose which websites you allow your employees to access. You can even go as far as to customize which employee can go to which website. For example, a marketing coordinator might need access to Facebook while an accountant doesn’t. Using web filtering, will cut down on time wasted by employees and hopefully increase productivity within your company.

3. Liability. You can’t monitor every employee around the clock. So, you never know what they might be doing when it comes to surfing the web. One employee might be conducting illegal activities and another could be searching for racial or sexist content. Companies may be liable for what their employees do at work when using the internet. You never want to put your company in danger! A sexual harassment claim or worst case scenario, a criminal charge, would be very destructive to your company’s image and finances. Don’t bear the brunt of that, use web filtering. Block any website that would allow employees to put your company at risk.

How can Carolina IT Group help you?

With our Barracuda web filter, we can help protect your company from cyber threats, reduce time wasted at work and block content that could put your company at risk. To contact us, fill out the form below or call (252) 565-1235.

Resources: PCWorld

Hard Drives Susceptible To Sound Waves, Can Double As Microphones

November 5, 2017 by Joseph Martin

File this one away under â€œobscure and terrifying.â€�

Recently, a security researcher named Alfredo Ortega, speaking at a security conference in Buenos Aires, unveiled research revealing that the hard drive in your computer can be, with a bit of work, turned into a rudimentary microphone and used to spy on you.

It should be noted that this hack only works on HDDs and takes advantage of the way they are designed. Understand that this isnâ€™t a flaw; itâ€™s simply the way the technology works.

An HDD cannot be read or written to if it is subject to vibration. Your machine has to wait for the oscillation to stop before it can perform an action. Modern OSs come with built-in tools that measure HDD operations to the nanosecond, and herein lies the secret of Ortegaâ€™s discovery.

The longer the delay, the louder the sound, and the more intense the vibration, which leads to longer delays in the read-write function of the drive.

Knowing this, Ortega figured that it would be possible to work backward and reconstruct the sound that caused the vibration on the HDD platters.

He was at least partially correct. While his reverse engineering technology is not yet sufficiently developed to pick up conversations, he notes that there is research that can recover voice data from very low-quality signals using pattern recognition. He figures that itâ€™s just a matter of time before someone applies it to his research.

Per Mr. Ortega: â€œI didnâ€™t have time to replicate the pattern-recognition portion of that research into mine. However, itâ€™s certainly applicable. For that reason, I would not discard that additional data like voice could be recovered in the future.â€�

It’s not something to be worried about immediately, but the dayâ€™s coming when your own hard drive could be used against you.

After Yet Another Equifax Hack, IRS Suspends Contract Worth $7.5M

November 4, 2017 by Joseph Martin

Equifax just can’t seem to get out of its own way.

Not long ago, the company suffered a massive data breach which saw the sensitive information of more than 145 million consumers exposed.

As a result, congressional hearings were convened, and the CEO resigned in disgrace. Amazingly, though, despite these events, the IRS opted to award the company a contract worth $7.5 million for its help and expertise in verifying taxpayer identification to prevent identity theft.

The irony did not escape the notice of security professionals around the world, who wrote literally hundreds of Op-ed and protest pieces.

Then, Equifax got hacked again. The company’s website was found to have been hacked, redirecting users to a malicious site that sent them to download adware.

Almost as soon as the issue was discovered, Equifax took the page down, insisting that this latest hack was due to a third-party contractor and did not constitute another breach of their network. However, that explanation was insufficient to the IRS, which suspended the recently awarded contract in response.

The decision has a real and immediate impact on the nation’s taxpayers because it will prevent them from creating new accounts through the IRS’s “Secure Access” program, which provides taxpayer access to transcripts and other records. If you already have an account set up, you will not be impacted.

The decision to pull the contract was seen as a positive development by the congressional committee convened to hold hearings on the matter, which concluded that, given the company’s recent track record, there was no real way to argue that this somehow increased user security.

On the other hand, as was pointed out by IRS Commissioner John Koskinen, the move would prevent literally thousands of recent hurricane victims from accessing their tax information.

Both points are true, but it’s hard to see how it could be argued that pulling the contract was the wrong move, even if it temporarily inconveniences a small percentage of taxpayers.

Popular Chrome Ad Blocker Faked, 30k Users Infected With Malware

November 3, 2017 by Joseph Martin

“Fool me once, shame on you. Fool me twice, shame on me,” as the saying goes. Unfortunately, Google has now been fooled by the same trick twice.

For the second time in recent years, Google has allowed a malicious variant of the popular extension “AdBlock Plus” onto its Chrome Web Store. It was noticed by a security researcher going by the alias “SwiftOnSecurity.” Before Google removed it, it had been installed more than 37,000 times by unsuspecting users.

This incident underscores a serious flaw in the way that Chrome extensions are uploaded to the Web Store.

The entire process is automated, and Google only intervenes if an extension is reported as being problematic. Unfortunately, given the automated nature of the process, it’s almost frighteningly easy to abuse, and since there are no significant checks on the front end, hackers can upload extensions bearing the same or highly similar names as extensions from legitimate developers. Unless a user clicks on the “reviews” tab to read what other users are saying about the extension, at first glance, they’d have no real way of knowing that there was a problem until they started experiencing it for themselves.

As mentioned, this is actually the second time this very extension was abused, the first being back in 2015.

As malware goes, this one is annoying, but not awful. Instead of blocking ads, it has a tendency to open multiple new windows, displaying a torrent of unwanted advertising. Fortunately, there don’t seem to be any other “hooks” built into the code, so it doesn’t install more destructive malware, but it’s still annoying.

All that to say, if you’ve been experiencing a sudden flurry of advertising popups, you may have been one of the unlucky few to have grabbed a malicious variant of an otherwise excellent web extension. If you have, just uninstall it and go grab a new copy, and you should be all set.

New Hack Attempts To Access Office 365 Passwords

November 2, 2017 by Joseph Martin

Companies are getting better at detecting and fending off brute force attacks. Depending on how big, and how hard-hitting the attack is, it can still get through, of course, but the main problem with such an attack is that it’s impossible to miss. The moment it starts, security professionals know what’s going on, and can immediately spring into action.

Of course, the hackers know this, and have been looking for ways around the problem. How can they launch an attack that will go unnoticed?

Now, it seems that they have a viable answer: low and slow.

It requires patience. Rather than hitting hard and all at once, this new attack vector utilizes a small number of machines and a low attack frequency in order to stay under the radar. Often, the hackers orchestrating such attacks will spread them out over weeks, or even months, and alternate between several different companies on the thinking that if it doesn’t trigger any alarms, then the security folks won’t go on high alert, and they can keep chipping away until they get lucky and break in.

While it hasn’t worked so far, the new approach did manage to go unnoticed for a number of months before the pattern was detected by SkyHigh Security.

The attack they discovered is an especially clever one. It has been going on since May, and it seeks to target email accounts not controlled by individuals, but used to fulfill other corporate functions. These are things like service automation, marketing and other system accounts.

The reason? Most of these don’t use two-factor authentication, and most people who check those types of accounts don’t expect to see malicious emails in those inboxes, and are thus more likely to click on embedded links, even if sent by accounts that are unrecognized.

Nothing is currently known about the group behind the attacks. They are focused on high-value targets in the financial services and medical fields and attempted to gain access to Office 365 accounts, which would give them access to a wealth of sensitive corporate information.

Although there’s no evidence that the attack has succeeded to this point, it is as clever as it is insidious, and definitely something to be aware of. From a practical standpoint, the strongest defensive move you can make is to be sure that all of the aforementioned types of email accounts are using two-factor authentication.

OnePlus Mobile Phone Found To Be Collecting User Data

November 1, 2017 by Joseph Martin

If you own a smartphone made by Chinese manufacturer OnePlus, you can thank security researcher Chris Moore for making a discovery that the manufacturer wasn’t going to tell you about.

It turns out that OnePlus phones running the OxygenOS are recording a disturbing amount of user data and sending it back to a company server. The data being collected on users include, but are not limited to:

• Any time the user locks or unlocks the phone

• Any time the user launches, uses or closes an app

• Which WiFi networks the device connects to

• The phone’s IMEI

• The phone number tied to the phone

• Mobile network names

All of this makes it very easy for the company to personally identify users.

When Moore was conducting his tests, he noted that the phone sent more than 16MB of data back to the server in a span of just ten hours. If you’re on a data plan with tight limits, that could max out your usage in no time.

The company issued a response to the findings, confirming that it does indeed transmit analytic data to an Amazon server in two distinct streams, one designed to help them fine-tune their software and the second for sale support, but insists that nothing nefarious is going on. They further stress that users can turn off some of the data collection by going into Settings  Advanced, and then deselect the option to “Join The User Experience Program” which is set to active by default.

Unfortunately, this only deactivates the first of the two data streams. It is apparently impossible to deactivate the second.

The company’s official explanation seems a bit thin, but unfortunately, there’s little to be done. While you can limit the amount of data collected on you, at this time, there’s no way to stop it completely. Keep this in mind if you use a OnePlus phone.

2012 Disqus Hack Exposed More Than 17 Million Users

October 30, 2017 by Joseph Martin

The hits just keep coming, with Disqus being the latest company to issue a breach disclosure. If you’ve never heard of it, Disqus is an incredibly popular, plugin-based comment service for blogs.

Although the breach was only just discovered, it occurred five years ago in July 2012 and impacted more than 17.5 million users.

Evidence of the breach was initially discovered by an independent security researcher named Troy Hunt. It was then reported to the company and disclosed 24 hours later by Jason Yan, the CTO of the company, who had this to say:

“No plain text passwords were exposed, but it is possible for this data to be decrypted (even if unlikely). As a security precaution, we have reset the passwords for all affected users. We recommend that all users change passwords on other services if they are shared.”

Mr. Yan’s advice is excellent, but unfortunately, it highlights a persistent, ongoing problem. Far too many people are still in the habit of using the same password across multiple websites, which means that when one site is breached, it potentially gives the hackers access to all your other accounts that have passwords in common.

It should be noted that since the breach, Disqus has made several upgrades to their security, including implementing even more robust encryption than they’d formerly been using. Again, per Mr. Yan:

“Since 2012, as part of normal security enhancements, we have made significant upgrades to our database and encryption to prevent breaches and increase password security. Specifically, at the end of 2012, we changed our password hashing algorithm from SHA1 to bcrypt.”

The problem is solved for now, but the damage has been done. The best thing you can do at this point is change your password immediately, stop using the same password across multiple websites and be on the alert for phishing emails designed to get you to give up even more information.

Disaster Recovery Plan: Preparing for the Storm Ahead

October 30, 2017 by Joseph Martin

How Long Will It Take to Get Your House in Order

When it comes to a proper disaster recovery plan for your business, do you feel satisfied and secure with simply having your data backup on a hard drive or in-house server? If you said yes, then you could be setting your business up for failure. Simply having your data backed up doesn’t account for the time and effort it’s going to take to get things back up and running again. Many business owners fail to take into account the time needed to re-install software, programs, apps and upload files and data back into their systems. Even that plan is taking for granted that your servers and backup devices have not also been lost or damaged.

Mother Nature Can Make Problems Too

In the age of technology, the common fears for any business falls primarily on viruses and hackers. However, Mother Nature poses just as much of a threat. Just as you keep anti-virus and security software in place to protect yourself from security breaches, you must also plan for the event of fires, tornadoes, floods and hurricanes. These forces of nature pose a serious threat to your business as they may cause the permanent loss of data through compromising your physical storage and backup devices. The loss of these storage devices could set you back days, weeks or even months when it comes to restoring your business and services. You MUST ask yourself, could my business continue to operate in the event of a data disaster, or how long will it take for you to get things up and running again?

A Cloud to Save You on a Rainy Day

Off-site services such as cloud data storage and secure servers are the must-have data backup solutions for any business. Not only are they an inexpensive security plan, they also allow your employees to continue to access their necessary programs, data and files even when they can’t access their office. Cloud solutions and secure servers can allow you and your employees to continue to serve your clients and operate your business from home or an alternate location while your primary office recovers from the disaster. This gives you the necessary business continuity you need to ensure clients remain satisfied and served and your business continues to operate on schedule. Cloud solutions and off-site servers can also offer you the ability to consistency backup your data to ensure things stay up-to-date. When it comes to flash drives and other tape drive backup solutions, you run the risk of missing regular updates and thus when it comes to the recovery process, your stuck using old data and run the risk of permanently losing crucial software and file updates.