Account Security

November 8, 2018 by Joseph Martin

Yahoo has the dubious honor of having been on the receiving end of the largest data breach in history. As a consequence, the company has recently agreed to pay $50 million in damages and provide free credit monitoring services to its impacted users.

The company actually suffered a pair of breaches in 2013 and in 2014, although this information was not disclosed by the company until 2016. All of the company’s 3 billion users were impacted, and more than 200 million of them saw losses arising from that breach.

The compromised data included: usernames, email addresses, dates of birth, security questions (and their answers) backup email addresses, and phone numbers exposed.

The particulars of the settlement are as follows:

Yahoo pays $50 million to users whose accounts were compromised

Yahoo pays $35 million in legal fees

People who paid for a $20 or $50 a year for a Yahoo Premium account will be eligible for a 25 percent refund

People who had their email accounts compromised will be compensated $25 per hour for the time they spent handling issues related to the breach. Although in this case, users with documentation will see their compensation limited to a maximum of fifteen hours, while users without documentation will be limited to a maximum of five hours of compensation

Any impacted user can request free credit monitoring, which the company will offer for two years

Verizon, which acquired Yahoo in 2017, will pay for half of the settlement cost. Meanwhile, Altaba (the company that arose from the remainder of the original Yahoo business) will pay the $35 million fine imposed by the US Securities and Exchange Commission for the company’s failure to disclose the breach to its investors.

It’s a landmark case, and once the deal gets final approval, notices will be emailed to affected account holders and published in People and National Geographic magazines.

Joseph Martin

President & CEO
I hope you enjoyed this article. My mission is to take your stress away from dealing with IT problems. Call (252) 565-1235 or send me a message at our contact us page if you have a question, comment or want help.

November 7, 2018 by Joseph Martin

As far as hackers are concerned, no target is safe. Not even the Girl Scouts.

Recently, one of the Girl Scouts’ official email accounts was accessed by an “unauthorized third party” and as a result, as many as 2,800 girl scouts in Orange County, California may have had their personal information compromised.

Gaining access to the account naturally gave the hacker access to every email sent from that account that had not already been deleted. When the breach was discovered, the Girl Scouts sent an email to every potentially impacted individual.

The email reads, in part, as follows:

“Some of the emails stored in this account, which included emails with dates as far back as 2014 through October 1, 2018, contained information about our members. Out of an abundance of caution, we are notifying everyone whose information was in this email account.”

Based on the information the account contained, compromised data varied widely from one person to the next. However, the data included details like email address, home address, health history information, insurance policy numbers and driver’s license details. In short, that’s more than enough information to steal an identity.

While this breach is not noteworthy for its scope and scale, it has been attracting a great deal of attention because it targeted children and young adults. Identity data belonging to this demographic is extremely attractive to hackers because it can often be monetized for months, if not years before red flags are raised.

Last year, more than a million children in the US were impacted by identity fraud. What’s worse, according to a report published by Javelin Strategy and Research, 60 percent of child identity fraud victims know the fraudster, compared with just 7 percent of adult victims.

The investigation is still ongoing, but if you live in Orange County, California, and have a child in the Girl Scouts, be on high alert.

Joseph Martin

November 6, 2018 by Joseph Martin

Do you use Tumblr? If so, be aware that your personal information may have been exposed.

Tumblr recently added a feature called “Recommended Blogs” that presents you with a list of blogs you might enjoy based on your past viewing habits. It’s a great idea in theory, but unfortunately, there were problems with the way the feature was implemented.

Any blog on the recommended list was placed there in such a way that it left the blog owner’s personal information exposed, including:

IP Address

Self-Reported location

Email Address

Password

Tumblr had this to say in an open letter published on their site:

“It’s our mission to provide a safe space for people to express themselves freely and form communities around things they love. We feel that this bug could have affected that experience. We want to be transparent with you about it. In our view, it’s’ simply the right thing to do.

We found no evidence that this bug was abused and there is nothing to suggest that unprotected account information was accessed.”

Even if you’ve never seen your Tumblr blog on the recommended list, your best bet is to change your password immediately. As usual, if you use the same password for Tumblr that you use on any other web property, change that password too.

Now would be a great time to break yourself of the habit of using the same password across multiple websites. Continuing that practice makes you a ticking bomb. Sooner or later, it’s going to explode on you, with tragic consequences that could take years to fully recover from.

We applaud Tumblr’s handling of this issue. At a time with other social media platforms are under fire for their handling of security flaws, Tumblr’s transparency is refreshing indeed.

Joseph Martin

November 6, 2018 by Joseph Martin

McAfee has long been a popular target of scammers, but recently, they’ve changed the nature of their game.

In years past, they’d display a webpage informing you that any McAfee products on your computer are out of date and provide a link to the company’s virtual storefront where you could renew.

Unbeknownst to the people clicking on those links, they were being redirected by an affiliate link, so any purchases made would generate a commission for the site owners.

It was an unscrupulous, underhanded tactic, but not an especially malicious one. Now though, they’re doing something a bit different and darker.

The same page pops up as before, notifying users that their products are out of date. This time, when a user clicks to renew their products, instead of being sent to the McAfee website, they’re simply presented with a capture box that asks for their credit card and personal information.

Assuming you enter that information in, it gets worse.

After “paying” for your purchase, you’re redirected to another webpage with a technical support phone number. The idea is, you call this number and the technician on the other end of the line will help you install your new software.

When you get someone on the phone, the “tech support representative” will ask to remotely connect to your computer.

Once they have access, they’ll tell you that your credit card information didn’t go through, and that you need to purchase the software again. They’d then helpfully open a browser and guide you to the McAfee website, via an affiliate link.

It’s a triple play. Not only are they earning a nice commission when you purchase the software via their affiliate link, but they also manage to get your credit card and personal information. That information will no doubt be put to use not long after you hang up the phone, and on top of that, they’ve got access to your device.

As ever, the best defense against scams like these is vigilance.

Joseph Martin

October 27, 2018 by Joseph Martin

You probably haven’t heard of the Centers for Medicare and Medicaid Systems.

They’re a low-profile division of the Department of Health and Human Services responsible for administering the Affordable Care Act.

Recently, the company announced that they detected anomalous activity in the systems related to the healthcare.gov website that brokers and insurance agents use to assist people who apply for healthcare coverage.

The abnormal activity was detected in the Federally Facilitated Exchange system, and the direct enrollment pathway in particular. This is connected to (but separate from) the healthcare.gov website itself.

A statement issued by the Centers for Medicare and Medicaid Systems said:

“At this time, we believe that approximately 75,000 individuals’ files were accessed. While this is a small fraction of the consumer records present on the FFE, any breach of our system is unacceptable… We will continue to work around the clock to help those potentially impacted and ensure the protection of consumer information.”

CMS made it clear that their investigation into the matter was still in its earliest stages.

They did offer the following additional information:

“Upon verification of the breach, CMS took immediate steps to secure the system and consumer information, further investigate the incident, and subsequently notify federal law enforcement. We are actively engaged in and committed to helping those potentially impacted as well as ensuring the protection of consumer information.”

Additionally, CMS stated that they identified the broker accounts that were associated with the anomalous activity and deactivated them out of an abundance of caution.

At some point in the near future, we can expect that CMS will be contacting those whose data was compromised and providing them with a series of next steps. The agency is already moving to bolster their security measures and promises that they’ll have them in place before the end of October 2018.

If you’ve used the healthcare.gov portal and required the assistance of a broker or insurance agent to get coverage for yourself and your family, there is a small chance your data may have been compromised. However, at this point, there’s no way to be certain. Be on the lookout for a communication from CMS in the near future, however, just in case.

Joseph Martin

October 25, 2018 by Joseph Martin

Google is taking additional steps to bolster user privacy and better secure the data of the company’s legions of Android device owners. The company recently announced a change to the Android Backup Service that will encrypt all user backup data stored on its cloud servers, such that even Google itself can’t read it.

Google has long allowed Android users to back up their app data and phone settings to their Google account so when they upgrade their phones, the process of getting the new device set up is quick and painless. However, until this recent change, none of the backup data stored was encrypted.

Beginning with Android Pie, the new encryption paradigm will work as follows:

Your Android device will generate a random security key that is unknown and invisible to Google

The key will be encrypted using your passcode, pattern, or lock screen PIN

Once encrypted, the key will be sent (securely) to a Titan security chip on Google’s servers

As Google explained in a recent blog post: “The Titan chip is configured to only release the backup decryption key when presented with a correct claim derived from the user’s passcode.”

All that sounds good in theory, but what about brute force hacking attempts? The company has an answer for that as well.

Here’s what they had to say about that topic:

“The limited number of incorrect attempts is strictly enforced by a custom Titan firmware that cannot be updated without erasing the contents of the chip…by design, this means that no one (including Google) can access a user’s backed-up application data without specifically knowing their passcode.”

The company has not specified which Android smartphones will be able to take advantage of the additional layer of security. All we know at this point is that the device must be running the latest OS (Android 9 – Pie). We expect to get a comprehensive device list from Google in the near future.

Joseph Martin

October 24, 2018 by Joseph Martin

Gamers take the games they play seriously. So seriously, in fact, that they’re not above resorting to dirty tricks to score a win.

Recently, social media has been abuzz with reports of a messaging app bug on Sony’s PlayStation devices. Specifically, there’s a bug in both the Android and iOS messaging apps that allow malicious gamers to send a poisoned character via group chat that will brick your gaming console.

If you’re in the middle of a tense death match, you lose by default, because you’re booted from the system entirely.

Here’s an example of what we’re seeing on Reddit:

“There is a new glitch that basically bricks your console and forces you to factory reset it. Even deleting the message from the mobile app doesn’t work. It happened to me during Rainbow Six: Siege. A player from the other team used a dummy account to send the message and crashed my entire team. We all have had to factory reset. Only one of our guys wasn’t affected, and he has his messages private.”

This note holds the key to the workaround until Sony makes some type of official response. If you haven’t yet had the dubious honor of being the recipient of this poisoned message, set your messages to private immediately.

Here’s how you do that:

Go to “Settings” and select “Account Management, Privacy Settings”

Enter your password

Select “Messages” and change it to either “Friends Only” or “No One,” then exit out of the subsystem. You’re all set from there.

If you’d rather change your message settings from your PC and a web browser, you can do that too, though the process is a bit different.

Here’s how:

From your PC, surf your way to the PSN Privacy Settings Management Page

Select “Personal Information/Messages”

Select “Edit,” then change the setting to either “Friends Only” or “No One.” Save and exit.

Joseph Martin

October 23, 2018 by Joseph Martin

Gaming and Gambling are huge industries with a truly global footprint. It’s no surprise then, that these industries have become an increasingly popular target for hackers.

Interestingly, according to the latest report issued by ThreatMatrix, the attack vector of choice when it comes to these industries is IP Spoofing. It has increased by a staggering 257 percent since this time last year, making it far and away the fastest growing attack vector in the gambling and gaming industry.

A spokesman for ThreatMatrix had this to say about the report:

“Rising cybercrime levels is no small issue for a sector that enjoys a truly global customer base. With more than two billion gamers worldwide, nearly 60 percent of the industry’s traffic is cross-border.

Operators must contend with a rapidly evolving regulatory landscape and stringent new anti-money laundering laws, making the verification of the true location of a transacting gamer a vital component in authenticating identity.”

Note that at least some of the increase in IP spoofing stems from the gamers themselves, specifically in countries where certain gaming activities may be illegal. Gamers who wish to participate anyway, in violation of their country’s laws, have to fake an IP address to make it appear that they are located in some other country.

Another key finding of the report is the fact that an increasing percentage of gamers and gamblers access sites primarily from their mobile devices. Mobile access has increased by 45 percent between this year and last. As of now, fully 71 percent of gaming and gambling transactions are made on a mobile device, which is serving to make them an increasingly attractive target for hackers.

A TreatMatrix spokesman continues to explain, saying:

“To deal with these challenges, gaming and gambling operators must incorporate dynamic digital identity intelligence that pieces together key indicators such as device intelligence, true geolocation, online identity credentials and threat analysis to better inform risk decisions. The key is to be able to effectively differentiate trusted users from fraudsters and understand changes in trusted user behavior without adding unnecessary friction.”

A daunting challenge indeed.

Joseph Martin

October 20, 2018 by Joseph Martin

As many as 30,000 people made up of a mix of both civilian and military personnel have had their personal and financial information exposed. This exposure is what has been reported as a major security breach of the Pentagon.

This is proof positive that no organization is safe from watchful hackers scattered all around the world.

The Associated Press report on the incident includes:

“The department is continuing to gather additional information about the incident, which involves the potential compromise of Personally Identifiable Information (PII) of DoD personnel maintained by a single commercial vendor that provided travel management services to the department. This vendor was performing a small percentage of the overall travel management services of the DoD…The department is continuing to assess the risk of harm and will ensure notifications are made to affected personnel.”

While there’s no good time for a data breach like this, it couldn’t have come at a worse time. The Government Accountability Office (GAO) had issued a scathing report of critical vulnerabilities in virtually all of the weapons systems programs the agency currently runs.

A small excerpt of the report reads as follows:

“One test report indicated that the test team was able to guess an administrator password in nine seconds…Multiple weapon systems used commercial or open source software, but did not change the default password when the software was installed, which allowed test teams to look up the password on the internet and gain administrator privileges for that software.”

It gets worse. When confronted with the findings of the report, Pentagon officials dismissed the report as being unrealistic.

Clearly, there was something to the report, or this breach would not have happened. The hope is that it will be sufficient to cause Pentagon officials to do some soul searching and reevaluate their positions. If not, you can bet that something like this will happen again.

Joseph Martin

October 17, 2018 by Joseph Martin

By now, almost everyone has heard of the Spectre and Meltdown security flaws that have been making headlines for more than a year. They’re serious flaws with dire implications for tens of millions of users around the world who have an intel-based PC.

The saga surrounding the fixes for these issues has been a long one and filled with twists and turns. Intel originally attempted to push a software fix to protect its chips, but the patch they issued was so flawed that the company requested users not install it and wait for a better, more reliable patch.

In time, that patch was issued, but unfortunately, the protection it offered carried a hefty price in the form of significant system slowdowns.

The longer-term solution was, of course, to re-engineer the chips themselves. Recently, Intel announced that some of their 9th Generation chips will come with built-in fixes to ward against both Spectre and Meltdown. Note the word “some.”

Specifically, the company’s new line of K-series chips, used in gaming CPU’s have been re-engineered to be resistant to those security flaws. Unfortunately, the X-Series (Xeon-class chips) don’t feature those security fixes.

The reason is that they’re based on the older Skylake-X architecture, and given that, the company is relying solely on software updates to protect those chips.

At a recent desktop press event, the company had this to say about the matter:

“…the new desktop processors include protections for the security vulnerabilities commonly referred to as ‘Spectre,’ ‘Meltdown,’ and ‘L1TF.’ These protections include a combination off the hardware design changes we announced earlier this year as well as software and microcode updates.”

Although Intel has been roundly criticized for its handling of the issues surrounding these flaws, this is undeniably a step in the right direction.

Joseph Martin

Contact Info

Navigation