Hacking – Page 5

Reddit Users Advised To Reset Their Passwords

August 14, 2018 by Joseph Martin

If you’re a Reddit user, it’s time to change your password. According to the company, they recently discovered evidence of a hack that exposed all company data from the site’s launch (2005) to 2007, including user emails and account credentials.

The company also reported that all public messages from that time period were downloaded, as well as an unknown number of private conversations.

In addition to that, the hacker was apparently able to access the logs containing the email digests that Reddit sent out between June 3rd and June 17th of 2018. Note that you were only impacted by this portion of the hack if you received an email from [email protected] between the dates mentioned.

Reddit is following what has quickly become standard procedure in the wake of an event like this. They reported the incident and are currently working with law enforcement to investigate the matter. Additionally, the company has bolstered its security, including making two-factor authentication a requirement to access all sensitive internal systems.

One slight departure from the standard response is this: Rather than notifying only the users whose email addresses and account credentials were compromised, Reddit is urging all users to change their passwords immediately and to enable two-factor authentication if you have not already done so.

It’s sound advice, but unfortunately, advice that only a minority of Reddit users will likely heed.

This is hardly the first high profile data breach in 2018, and it certainly won’t be the last. Each new breach reported on only sounds the alarm more loudly. Corporate systems are woefully insecure, and the hackers are finding more and more success. 2018 is on track to break the record set in 2017 for the most breaches in the history of the internet, and next year will probably break the record set later this year.

As ever, vigilance is the key.

Joseph Martin

President & CEO
I hope you enjoyed this article. My mission is to take your stress away from dealing with IT problems. Call (252) 565-1235 or send me a message at our contact us page if you have a question, comment or want help.

Click Rates For Spam Emails Are Increasing

August 14, 2018 by Joseph Martin

F-Secure recently published a new report, and their findings are disturbing.

The click rates on spam emails increased to 14.2 percent for the second half of 2017, up from 13.4 percent reported in the first half of 2017.

The increase seems to be driven by two factors.

First, more intense targeting of smartphone users, who are typically more distracted and not paying as much attention when opening and reading emails.

Second, a slight increase in sophistication. For instance, an email that appears to come from a known sender is 12 percent more likely to be opened and responded to, so hackers are using this approach more often.

Even so, the report isn’t all bad news. While spam is still the most common means of attack, it’s highly inefficient, relying on brute force (volume) rather than an abundance of sophistication. Second, the report reveals that 85 percent of malicious attachments are made up of just five file types:

*.7z

*.PDF

*.XLS

*.DOC

*.ZIP

Knowing this, a savvy user who’s paying attention can more easily avoid falling into the trap of the hackers.

Other highlights from the report include:

46 percent of all spam campaigns are related to online dating

23 percent contain the malicious attachments described above

31 percent contain links to malicious websites

Sean Sullivan, an F-Secure Security Advisor had this to say about the report:

“We’ve reduced criminals to spam, one of the least effective methods of infection. Anti-malware is containing nearly all commoditized bulk threats. And honestly, I don’t see anything coming over the horizon that could lead to another gold rush, so criminals are stuck with spam.”

Overall, the report is bad news mixed with some good. One thing it clearly underscores is the continuing importance of ongoing email education for all employees of companies of any size.

Joseph Martin

New Scam Targets Apple Users

August 11, 2018 by Joseph Martin

There’s a new, surprisingly elaborate phishing scam targeting iPhone users. The scam starts with an email informing users that their phones have been locked due to “illegal activity” and instructing them to call “Apple Care” to get the problem fixed.

Of course, there is no such company as Apple Care, but it’s an official enough sounding name that it’s luring a surprising percentage of victims into calling. In fact, opening the email will open a call dialog box, making connecting to “help” a very simple, and incredibly tempting option.

Naturally, the person on the other end of the phone isn’t tech support, but a hacker who’s looking to obtain as much information about the caller as possible. It’s a well thought out, well-engineered scam and it’s taking a lot of people in.

Given that smartphones have officially overtaken PCs as the primary means of surfing the web, it should come as no great surprise that phishing attacks targeting smartphone users are on the rise. Since most people keep their whole lives on their phones these days, it’s no wonder that so many people are quick to try and get help at the first sign of trouble with their cherished device.

Hackers are all too aware of that fact and are increasingly using it to prey on unsuspecting victims. Unfortunately, people tend to be more distracted when they’re on their phones versus when they’re using a PC, which explains why phishing attacks directed at smartphone users tend to succeed more often than they do against PC users.

Don’t fall for it.

Train your brain to be more mindful of any email you get that hints at a problem with any account or device you control. The best thing you can do if you get an email like that would be to close it and test the account or device yourself to verify that it’s locked. If it isn’t, delete the email and assume it was a scam. If it is locked, reach out to the company directly, rather than clicking links embedded in an email, or calling numbers obtained from an email.

That’s still not a fool proof solution, but it will help to minimize your risks.

Joseph Martin

Connecting To Aiport Wi-Fi Puts Your Data At Risk

August 9, 2018 by Joseph Martin

File this away under things you already knew. Coronet recently released a report entitled “Attention All Passengers: Airport Networks Are Putting Your Devices & Cloud Apps At Severe Risk,” and the news is about what you’d expect.

The report was more than five months in the making. The analysts poured over oceans of data on device vulnerabilities and Wi-Fi network risks from more than a quarter of a million consumer and corporate endpoints that passed through the 45 busiest airports in the United States.

The bottom line is simply that airport Wi-Fi is woefully unsafe, especially as compared to most corporate networks, and anyone connecting to those networks is asking for trouble.

Some offenders proved to be worse than others. The report names the San Diego International Airport, John Wayne Airport – Orange County (CA), and the William P. Hobby International Airport (Houston, TX) as being among the least secure in the nation.

The risk is that while traveling, most people don’t think about what network they’re connecting to or how secure it might be. This is an incredible opportunity for hackers, because once an employee’s laptop or mobile device is infected, the integrity of the employers’ cloud-based work apps is jeopardized.

Coronet’s founder, Dror Liwer, had this to say about the findings:

“Far too many US airports have sacrificed the security of their Wi-Fi networks for consumer convenience. As a result, business travelers in particular put not just their devices, but their company’s entire digital infrastructure, at risk every time they connect to Wi-Fi that is unencrypted, unsecured, or improperly configured.

Until such time when airports take responsibility and improve their cybersecurity posture, the accountability is on each individual flyer to be aware of the risks and take the appropriate steps to minimize the danger.”

Be sure your employees are aware of the risks any time they travel. Your company’s future might depend on it.

Joseph Martin

E-Mail Is A Big Threat To Your Organization

August 4, 2018 by Joseph Martin

Mimecast’s 2018 “State of Email Security” report is out, and although it’s contents are hardly a surprise, the news it contains is mostly bad.

For starters, it confirms what most IT professionals already know:

Email continues to be a big threat for organizations of all sizes.

Unfortunately, the C-Suite (CEO’s, CIO’s, CFO’s, and the like) are a major part of the problem, representing a significant weak link in Enterprise security. Not only are they a prime target for hackers, but according to the survey, 40 percent of respondents agreed that their organization’s CEO was a painfully “weak link” in their organization’s cyber-security operations.

Just as alarming, 31 percent of respondents said that C-level employees are very likely to have accidentally sent sensitive or proprietary information to the wrong person, a statistic up 9 percent from last year.

In addition to that, email is the primary means by which ransomware winds up getting inside company networks. This comes with a staggering 92 percent of successful ransomware attacks arriving via that channel, resulting in three or more days of downtime for the impacted companies.

Phishing attacks also continue to be a major issue, with 90 percent of respondents reporting an increase in the number of phishing attacks they were subjected to.

In light of these statistics, one would imagine that companies would be devoting significant resources to countering the threat. Unfortunately, that’s just not happening. Sure, money is being spent on infrastructure, but humans are the weakest link in this chain, and not just in the C-Suite. According to the survey, only 11 percent of organizations continuously train their employees on how to spot cyberattacks, and just over half (52 percent) perform training just once a year.

Matthew Gardiner, a cyber-resilience expert at Mimecast, summarizes it this way :

“Security awareness is an important part of any high-functioning security program. But like all security controls, there is no silver bullet solution. The best security programs seek a balance between technical controls, boosting their human firewalls, and having IT enabled business processes that are resilient to failures, whether man-made or caused by technology.”

Indeed.

Joseph Martin

Bluetooth Vulnerability Allows Hackers To Access Devices

August 1, 2018 by Joseph Martin

There’s a new Bluetooth security vulnerability to be aware of, tracked as CVE-2018-5383, and it’s a nasty one.

It’s a cryptographic vulnerability that affects firmware or operating system software drivers from a number of major vendors, including Qualcomm, Broadcom, Intel and Apple. At this point, the implication of the bug on Linux, Android, and Google are unknown.

The flaw is related to two important Bluetooth features: BR/EDR implementations of Secure Simple Pairing in device firmware and Bluetooth Low Energy (BLE) of Secure Connections Pairing in OS system software.

It was discovered by researchers operating out of Israel’s Institute of Technology. They discovered that the Bluetooth specification recommends (but critically does not mandate) that devices supporting the two features make any effort to validate the public encryption key received during secure pairing.

Since the specification is optional, it’s hardly a surprise that some vendors producing Bluetooth products do not take sufficient steps to validate the parameters used to generate public keys during the exchange.

This allows a would-be hacker the possibility of executing a man-in-the-middle attack to obtain the cryptographic key used by the device. This would give them the opportunity to not only spy on the device’s owner, but also to inject malware that could allow the hacker to take full control over the device.

SIG (the Bluetooth Special Interest Group which maintains the technology), had this to say about the flaw:

“For an attack to be successful, an attacking device would need to be within wireless range of two vulnerable Bluetooth devices that were going through a pairing procedure.

The attacking device would need to intercept the public key exchange by blocking each transmission, sending an acknowledgement to the sending device, and then injecting the malicious packet to the receiving device within a narrow time window. If only one device had the vulnerability, the attack would not be successful.”

Bluetooth SIG has now updated the specification to require products to validate public keys received as part of the public key-based security procedures. Of the manufacturers mentioned above, Apple and Intel have both released patches. Broadcom has made fixes available to its OEM customers who are responsible for providing them to end-users. There has been no word yet from Qualcomm.

Joseph Martin

Hackers May Set Their Sights On Your GPS Next

July 30, 2018 by Joseph Martin

If you’re like most people, you probably rely heavily on the GPS function of your phone. Type in an address and your phone helpfully guides you, turn by turn, to your destination. It’s one of the most often utilized features of a smartphone, and of course, the hackers are very interested in interfering with it.

Until now though, hackers have been unable to fool humans into driving to the wrong destination by hacking their GPS, because their instructions often make no sense given the prevailing terrain features the humans are seeing on the road. For instance, nobody is going to turn left into a Jiffy Lube parking lot or a corn field just because GPS says to (unless your destination was Jiffy Lube, of course).

That’s changing, thanks to researchers from Virginia Tech and the University of Electronic Science and Technology of China.

The team has devised a way to hack into a GPS system and spoof the results well enough to fool humans, giving bogus driving directions that seem to make sense given local conditions, and as such, don’t raise red flags.

Accomplishing the task was no small feat, involving the creation of an algorithm that works in something close to real time. This along with a portable device for spoofing GPS that can be attached to the car of your target or placed in a trailing car. Its effective range is about fifty meters.

Once the equipment is in place, the algorithm crafts GPS inputs that follow the real world road network, allaying suspicion in 95 percent of the team’s test cases, while still ultimately sending the target to the wrong destination.

There are any number of ways this exotic type of attack could be used, but the two primary use cases would be to intentionally steer the target into hazardous road conditions, or to lure them to an isolated area where a physical attack could be carried out.

Unfortunately, in the months and years ahead, we can probably count on seeing both.

Joseph Martin

New Report Shows 32 Percent Increase In Cyber Attacks

July 28, 2018 by Joseph Martin

Positive Technologies has just released a new report that paints a grim picture for IT professionals. If your sense is that the number of cyberattacks are increasing, you’re not wrong. In fact, it’s probably worse than you realize.

So far this year, we’ve seen a staggering 32 percent increase in the total number of cyberattacks in the first quarter of 2018, compared to the same period last year. Even worse, malware attacks have increased by a mind-bending 75 percent since the first quarter of 2017.

Individuals were far and away the most frequent target (28 percent), but government agencies came in a reasonably close second (16 percent), with business in the healthcare, finance, and IT sectors rounding out the top five (8 percent, 7 percent, and 5 percent, respectively).

Of the malware deployed against targets this year, spyware was by far the most common, with stealth cryptocurrency mining software not far behind.

Leigh-Anne Galloway, the cyber security resilience lead at Positive Technologies explains in more detail:

“Our research shows that 63 percent of attacks included use of malware. Spyware, in particular, is used most often because it allows obtaining not only personal information and corporate secrets, but credentials for the services and systems needed to attack internal corporate infrastructure.”

Long story short, the prevalence of spyware seen in this report is likely to have cast-off effects in the future. Hackers will gain a sufficient level of access and information, courtesy of their successful spyware attacks, to launch even more harmful attacks against both individuals and government/corporate institutions in the future.

Positive Technologies warns that the number of attacks is likely to continue to escalate, and that there’s no clear end in sight.

The report is dark news if you’re in the digital security business. If your business hasn’t been hit yet, it seems that it’s just a matter of time.

Joseph Martin

Survey Shows Businesses Feel Prepared For A Data Breach

July 27, 2018 by Joseph Martin

A majority of business owners from around the world (68 percent) feel that they’re better prepared to ward off a cyberattack and prevent a data breach than their competitors. This is a figure which is up 8 percent over last year’s statistic for the same question. This, according to a recent survey by FICO.

In the US, power and industrial companies were the most confident, with 86 percent of companies from these sectors rating their firms as either above average, or top-tier in terms of their preparedness. The US financial firms were the least confident, with only 60 percent rating their firms as either above average or top-tier.

Telecommunications companies fell somewhere in the middle, with 72 percent of respondents ranking themselves above average or top-tier.

It may be premature to break out the champagne.

Maxine Holt, a research director on the team conducting the survey says:

“IT leaders have greater funding than ever to protect organizations from the continuously evolving threat landscape and meet complex compliance demands.

These same IT leaders are undoubtedly keen to believe that the money being spent provides their organization with a better security posture than any other – but the rapid pace of investment, often in point solutions, rarely takes an organization-wide view of security.”

In short, the increase in confidence might be illusory. The risk is that if too much is read into these numbers, it may lead to overconfidence, which could lead to an under-investment in security in subsequent years. This can ultimately set these companies (or at least some of them) up for failure and disappointment when their expensive security measures prove not to be nearly as effective as they initially believed.

Even if you didn’t participate in the recent survey, it bears asking the question: How would you rate your company’s ability to fend off an attack, relative to your competition?

Joseph Martin

Clinic Employee Learns That Traveling Increases Data Theft Risk

July 25, 2018 by Joseph Martin

On May 14th, the Billings Clinic in Montana issued a breach notification statement, which explained that they detected unusual activity within one of its employee’s email accounts.

The employee in question was traveling overseas on a medical mission when the email account was compromised.

“As a result of the forensics investigation, we learned that an unauthorized individual had access to emails and attachments within that one account, some of which included patient information.”

As for scope and scale, information on more than 8,400 individuals was exposed. While the data varied from one patient to the next, the data included patient names, dates of birth, contact information, medical record numbers, internal financial control numbers, diagnoses, and some information about medical services received.

The incident highlights a common, but often overlooked problem.

As analyst Rebecca Herold explains:

“It is very common for data and devices to be hacked while traveling and for those who were hacked to not even realize it. People are often unaware of what is going on around them when they are travelling. They are using any charger station they can find, they speak loudly, and they use free Wi-Fi.

Shoulder surfing is also still very common; it’s a decades-old tactic that still works effectively today. The skimmers on charging stations are increasing in use. Don’t think that if you are in a frequent flyer lounge that these things do not happen there; they happen in those exclusive lounge areas possibly more than in other places.”

The bottom line is, any time your employees are away from your office, the risks of hacking increase. While there are no simple solutions, it bears making your employees aware of the added risks any time they’re travelling. It’s far from a perfect solution, but it’s a good place to start.

Joseph Martin

« Previous Page
1
…
3
4
5
6
7
…
16
Next Page »

Reddit Users Advised To Reset Their Passwords

Click Rates For Spam Emails Are Increasing

New Scam Targets Apple Users

Connecting To Aiport Wi-Fi Puts Your Data At Risk

E-Mail Is A Big Threat To Your Organization

Bluetooth Vulnerability Allows Hackers To Access Devices

Hackers May Set Their Sights On Your GPS Next

New Report Shows 32 Percent Increase In Cyber Attacks

Survey Shows Businesses Feel Prepared For A Data Breach

Clinic Employee Learns That Traveling Increases Data Theft Risk

Contact Info

Navigation