Account Security

Major Facebook Breach May Have Affected Your Account

October 16, 2018 by Joseph Martin

Facebook got hit hard by a currently unknown group of hackers. If you recently found yourself inexplicably logged out of the social media site, Facebook did it in response to the breach.

The breach resulted in the theft of data pertaining to more than fifty million of the site’s users.

Here’s what we know so far about the attack:

The hackers pulled off their heist by taking advantage of three different vulnerabilities.

Facebook detected the breach after spotting an unusual spike in traffic.

Your password has not been compromised, but unfortunately, the hackers don’t need it.

The hackers stole more than fifty million access tokens. These tokens can be used to take over Facebook accounts without passwords, even if you have two-factor authentication enabled.

If you were in the compromised group, the hackers have every scrap of personal information you’ve entered into the social media site.

If you use the “Logged in as Facebook” feature on other websites, those accounts are also at risk. The hackers can use the stolen tokens to access any site you log into with your Facebook credentials.

The reason you got logged out was because Facebook reset access tokens for everyone they suspected may have had their data stolen.

To find out if you’ve been hacked, you can check “Active Sessions” on Facebook. If you see an unknown IP address, or a location in some other country, that’s a sure sign that you’ve been hacked.

This breach is not connected in any way to the hacker who pledged to delete Mark Zuckerberg’s personal Facebook page.

In addition to that, you should know that Facebook is now facing a class-action lawsuit over the hack. The suit alleges that the company failed to protect their personal data from falling into the wrong hands due to the company’s lack of proper security practices.

While the vulnerabilities have been fixed, the class-action lawsuit has a good chance of succeeding. The investigation is still in its early stages, and there may be updates to this story as we learn more.

Joseph Martin

President & CEO
I hope you enjoyed this article. My mission is to take your stress away from dealing with IT problems. Call (252) 565-1235 or send me a message at our contact us page if you have a question, comment or want help.

Apple IOS12 Users’ Photos And Contacts May Be Vulnerable

October 13, 2018 by Joseph Martin

Jose Rodriguez, a Spanish Apple enthusiast, has discovered a new security flaw to be aware of. He posted a Proof of Concept video showing the exploit in action.

We’ll say upfront that this is a highly convoluted attack involving more than two dozen discrete steps. A hacker would need to be in possession of the phone to pull it off, so it’s not something that’s likely to become a major threat.

Even so, we’ll provide the details below.

Apple has built in security measures that are designed to prevent someone from tricking Siri into allowing unauthorized access to the phone. Unfortunately, by using a complex series of steps involving both Siri and Apple’s Notes application, it’s possible for a hacker to bypass those security measures, access images stored on the phone, and then change the image associated with a contact or the owner of the phone.

This method is effective on both iOS12 and the iOS 12.1 beta, which means that Apple’s recent patch to their OS does not and will not prevent this exploit from working. Worse, the company has yet to comment on the matter, so at this point, there’s no timetable for a fix.

The independent news site Threatpost has been able to replicate the attack, so we have third-party confirmation.

Fortunately, there’s a simple way to negate the attack entirely while we’re waiting for a patch to close the loophole once and for all. Simply go to Settings – Face ID & Passcode – Touch ID & Passcode, and disable the “Allow access when locked” option for Siri.

Again, it’s important to reiterate that this is a highly complex attack that involves having both physical access to the device and more than two dozen steps, so this is not an issue that’s likely to be widespread. Even so, it pays to take precautions until Apple can roll out a fix.

Joseph Martin

Payment Pages Are Being Compromised To Steal Data

October 10, 2018 by Joseph Martin

Symantec’s most recent statistics have revealed a disturbing trend. Malware designed to compromise checkout pages is seeing a big spike in use, with the company reporting a staggering 248,000 attempts since August 13th of this year, with more than a third of them (36 percent) between September 13th through September 20th. As disturbing as those numbers are, that’s just the tip of the iceberg.

As Symantec notes on their website:

“If we compare the week of September 13 to 20 to the same week in August, the number of instances of formjacking attacks blocked by Symantec more than doubled, jumping from just over 41,000 to almost 88.500 – a percentage increase of 117 percent.”

Leading the surge is a particularly nasty strain of malware known as “Magecart.” Magecart campaigns are quite robust that begin by breaching the target website, then injecting malicious scripts into it that are designed to scrape card details and other customer information provided during the checkout process. This is an attack that’s alternately known as formjacking, payment card scraping, and web-based skimming.

Symantec isn’t the only company to take note of the trend. RiskIQ has been sink holing domains associated with Magecart infrastructure for much of the month and alerting companies compromised by Magecart attacks as they find them.

Kevin Beaumont, an independent security researcher, had this to say via Twitter :

“#TrackingMagecart I’ve updated the IoCs to double the number of domains, now tracking over 1000 objects – some of the domains have now been sink holed. Recommend InfoSec vendors block/flag domains.”

Magecart isn’t new. Security researchers have been tracking it since 2015, and independent researcher Willem de Groot has created a malware scanning website called MageReport, which allows business owners to check to see if their Magento-based webshop is vulnerable to this type of attack. If you think you might be, it certainly bears making use of.

At present, the one thing that’s not known is the reason behind the sudden spike. Only that it’s happening.

Joseph Martin

How Long Before You Experience A Cyber Attack?

October 9, 2018 by Joseph Martin

According to this year’s Traveler’s Risk Index, published by The Traveler’s Indemnity Company, a majority of business owners have a somewhat fatalistic view of hacking and data breaches.

The index includes 52 percent of survey respondents indicating that they believe a cyber-attack is inevitable.

The other statistics in the report paint a grim picture. Here’s a quick overview:

55 percent of business owners say that they have not completed a cyber risk assessment

63 percent say that they have not yet completed a cyber risk assessment on vendors who have access to their data

62 percent indicate that they have not yet developed any kind of business continuity plan, which means they don’t even have the basic outline of the steps they’ll need to take in the face of a successful attack against their company

The number of survey participants saying they have been the victim of a cyber attack has doubled from 10 percent in 2015 to 20 percent in this year’s survey

Yet in spite of this staggering lack of preparation, fully half of all survey respondents say they have cyber insurance.

Tim Francis, the Enterprise Cyber-Lead at Travelers, had this to say about the report:

“Cyber risks carry serious consequences for any business, threatening everything from revenue to operations. These findings reveal some surprising things about how companies view their cyber exposure, their relative confidence in dealing with them and the clear opportunity that exists for them to be better prepared for a cyber-attack.”

It’s a thorny problem, for sure. Most small to medium sized business are strapped for cash and simply can’t dedicate the level of resources they’d like to toward data security.

The good news is that this most recent survey reveals a few simple, low-cost things you could do starting today that would dramatically improve your chances of dealing with a cyber-attack. Given that most people agree it’s inevitable and just a matter of time, that would be an excellent place to start.

Joseph Martin

Firefox Adds Data Breach Monitoring Service

October 6, 2018 by Joseph Martin

Firefox is upping the ante where digital security is concerned, having just announced the release of a new, free service called ‘Firefox Monitor.’ The new service is designed with one specific goal in mind: To assist users in finding out if their accounts were exposed via a data breach.

It was developed in partnership with Troy Hunt, whose website, “Have I Been Pwned” is one of the most popular destinations on the web for security-minded individuals. This website, in fact, is the driving force behind Mozilla’s new service.

People will be able to engage with the service in two different ways. First, by making a direct inquiry to check the status of their various accounts, passwords, and email addresses that may have been compromised. Or second, by configuring the new subsystem to notify them when their information has been detected by the system.

Nick Nguyen, of Mozilla, had this to say about the new feature:

“It can be hard to keep track of when your information has been stolen, so we’re going to help by launching Firefox Monitor, a free service that notifies people when they’ve been part of a data breach. After testing this summer, the results and positive attention gave us the confidence we needed to know this was a feature we wanted to give to all of our users.”

If you find out via active polling or receive a notification that one of your accounts was compromised, you should take action immediately. You should change the password and audit the account to address instances where you may have used the same password associated with the compromised account in order to minimize your risks.

This is great news, and a fantastic addition by Mozilla. While it’s not a magic bullet that will solve all your security woes, it should help give users greater peace of mind, and it puts a powerful new tool in their hands to monitor the integrity of their own accounts. Kudos to Mozilla!

Joseph Martin

Government Payment Processor Exposes Data On Millions Of Americans

October 4, 2018 by Joseph Martin

If you use the GovPayNet portal, be advised that your personal information is currently at risk. Although at this point, there’s no indication that any hacker has made use of it. The portal is run by Government Payment Service, and is used by many Americans to pay fines, fees and bills generated by more than two thousand different government agencies operating in 35 states.

Unfortunately, the way the website is configured, when it issues a receipt for a payment, it numbers those receipts sequentially. All a hacker would have to do would be to change the receipt number in the URL to see any previous receipts, and all of the information it contains.

When the flaw was discovered by journalist Brian Krebs, more than fourteen million old records were exposed in this manner. He contacted Government Payment Service to inform them of the flaw, and the agency moved quickly to address the issue. They said in a formal statement that they “did not adequately restrict access to only authorized recipients.”

They went on to assure their users that there’s no indication that any data had been improperly accessed. They added that the receipts generated don’t include any information that could be used by a hacker to initiate any type of financial transaction.

Unfortunately, the reality was a bit different. The receipts contain the names, addresses and phone numbers of the person paying the fee in question, along with the last four digits of whatever credit or debit card was used to make payment. That is more than enough information to enable a hacker to initiate a phishing attack to get the rest.

Nick Bilorgoskiy of Juniper Networks had this to say about the matter:

“Online payment providers…should take special care to protect their customers’ receipts by using HTTPS and checking that the user is logged in and has permissions to view them. To avoid information disclosure and directory traversal issues, I also recommend denying anonymous web visitors the ability to read permissions for any unnecessary files from web-accessible directories.”

It’s good advice, and here’s hoping that Government Payment Service will take it. If you use the service, there’s nothing for you to do. You don’t need to change your password, since it was never exposed. Just be mindful that someone may have seen any data your receipts contain before the site was secured.

Joseph Martin

Data Breach Notifications May Get Standardized

October 2, 2018 by Joseph Martin

A new piece of legislation is making its way through the halls of Congress that could standardize and streamline the data security and breach notification process for financial institutions. This is something that most people in the industry tout as an improvement over the current situation.

The Consumer Information Notification Requirement Act (H. R. 6743) legislation was approved by committee not long after Congress received a letter cosigned by members from the American Bankers Association, the Consumer Bankers Association, the Credit Union National Association, the Independent Community Bankers of America and the National Association of federally-Insured Credit Unions.

The letter read, in part:

“Our existing payments system serves hundreds of millions of consumers, retailers, financial institutions and the economy well. Protecting this system is a shared responsibility of all parties involved and we must work together and invest the necessary resources to combat never-ending threats to the payment system.”

Despite so many influential organizations weighing in, many state regulators are skeptical of the proposed legislation and are actively pushing back against it over concerns that it would undermine state-level authority.

Whether you agree that those are valid concerns or not, the reality is both stark and terrifying. In the first half of 2018, ThreatMatrix recorded more than 81 million cybercrime attacks against financial institutions. 27 million of those targeted the mobile channel, given greater mobile banking adoption rates.

ThreatMatrix weighed in on the debate saying, “Financial services mobile transactions are growing globally, with China, South East Asia and India showing the strongest regional growth. Overall, the biggest threat in financial services comes from device spoofing, as fraudsters attempt to trick banks into thinking multiple fraudulent log-in attempts are coming from new customer devices, perhaps by repeatedly wiping cookies or using virtual machines.”

Clearly, something must be done, and while the politicians debate the issue, the attacks continue unabated.

Joseph Martin

An Exploited Website Can Cause Apple Products To Crash

September 28, 2018 by Joseph Martin

Users of Apple tech have a new reason to worry. A security researcher named Sabri Haddouche, who works for an instant messaging app called “Wire,” has published a proof of concept web page. It contains a fatal exploit that can crash and restart iPhones, iPads and any Mac.

Essentially then, the entire Apple ecosystem is vulnerable. Worse, the security flaw can be exploited using nothing more than CSS and HTML code. The flaw resides in Apple’s WebKit, which is its web rendering engine used by all apps and browsers running on Apple’s OS.

Haddouche tested the exploit using Chrome, Microsoft Edge, and the Safari web browser. He got the same result each time using both a MacBook Pro and an iPhone X. Apple users are advised to exercise extreme caution when visiting any web page until a patch can be issued.

The company is currently investigating the issue, and to this point has not given their legions of users a timeframe for a possible fix.

Sadly, this isn’t the first time a flaw like this has been discovered, and it’s unlikely to be the last. If there’s a silver lining, it is that Apple has historically been quick to patch flaws of this kind, and it should be noted that Linux and Windows systems are not affected.

It’s especially worrisome for small business owners, and until Apple gives us a time frame for a fix, your best bet is to steer clear of any websites but those that are business critical, and trusted sites that you know to be safe.

Although the exploit was specifically engineered to crash Apple devices, it’s easy enough to envision a nastier implementation which could critically damage the OS, rendering the device targeted by the attack completely inoperable. Stay vigilant, and stay tuned for a fix to what could be a devastating issue.

Joseph Martin

Popular NAS Device May Easily Be Compromised

September 27, 2018 by Joseph Martin

Western Digital has a big problem, and if you use the company’s “My Cloud” network-attached storage (NAS) storage devices, you’ve got one too. The WD My Cloud service is enormously popular because it’s so convenient, allowing both business owners and individuals to store their files, perform periodic backups, and of course, access their data from anywhere in the world.

Recently, security researchers have discovered an authentication bypass vulnerability that could allow an attacker to gain admin-level control over the device. This means they’d be able to monitor all of the files sent to, opened, or deleted on it, make copies of, or even delete the files found there.

The vulnerability has been given the designation CVE-2018-17153 and is about as serious as it gets. Without going into the technical details, essentially, all a hacker would have to do to take complete control over the device is for the hacker to “tell” the device that he’s an Admin via an uploaded cookie file. The device will accept it with no password required.

When the researchers notified Western Digital of the security flaw, they also released a proof of concept detailing the attack, and disturbingly, it can be executed using just six lines of code.

There is one silver lining in that to make use of the exploit, the hacker would need either local access or an internet connection to a specific WD My Cloud device. But this is a relatively low bar that most any experienced hacker could clear without a trace.

Western Digital has responded quickly, and according to a recent blog post on the company’s website, promises to have a patch that will resolve the issue “within a few weeks.” They also stressed to their customers the importance of ensuring that the firmware on all their products is always up to date and recommended enabling auto updates.

It’s good advice that will simplify your life and ensure you never miss an update, although not always practical for SMBs.

Joseph Martin

Malware Reports Continue To Rise

September 26, 2018 by Joseph Martin

We’ve known for some time now that the next big crisis the internet will have to come to grips with is the dramatic rise of the Internet of Things (IOT).

The problem isn’t with the devices themselves, which are enormously helpful and rapidly growing in their popularity. Rather, it lies in the fact that the overwhelming majority of IoT manufacturers have been notoriously lax when it comes to building even basic security protocols into the goods they make and sell.

The lack of security and the complete absence of any type of security has made the Internet of Things the new “low hanging fruit” of the internet, and hackers have been happy to take advantage of the incredibly easy access.

Kaspersky Lab has recently given us hard numbers to provide a sense of the scope and scale of the problem.

Last year, the company detected a total of 32,615 malware infections on IoT devices. In just the first six months of this year, the company has spotted 121,588 infections on IoT devices, representing a staggering 273 percent increase.

Far and away, the most commonly compromised devices were routers. Behind them were a whole raft of other IoT devices including smart TVs, refrigerators, DVRs, printers, washing machines and more.

Things have gotten so bad that earlier this year, the FBI issued a public service announcement in a bid to warn users of the dangers of unsecured devices.

These can be slaved by hackers to create enormous botnets like the one that brought down the internet on the entire eastern seaboard earlier this year. However, if they are connected to your home or office network, they provide a perfect launchpad for attacks against other network connected devices.

Sadly, manufacturers to this point have shown little interest in beefing up the security of the devices they sell, so the problem is likely to get much worse before it starts getting better.

Joseph Martin

Apple IOS12 Users’ Photos And Contacts May Be Vulnerable

Payment Pages Are Being Compromised To Steal Data

How Long Before You Experience A Cyber Attack?

Firefox Adds Data Breach Monitoring Service

Government Payment Processor Exposes Data On Millions Of Americans

Data Breach Notifications May Get Standardized

An Exploited Website Can Cause Apple Products To Crash

Popular NAS Device May Easily Be Compromised

Malware Reports Continue To Rise

Contact Info

Navigation