Identity Theft

WiFi Sync on iOS Vulnerable To TrustJacking

May 10, 2018 by Joseph Martin

Owners of Apple devices have a new attack vector to worry about, called “TrustJacking.” Symantec researchers recently stumbled across a pair of scenarios that take advantage of Wi-Fi syncing of various Apple devices. These are scenarios that also take advantage of the trust users have in the security of their own devices, allowing hackers to take complete control over those devices.

The flaw is a consequence of the way that iTunes Wi-Fi Sync is designed. The vulnerability manifests when a device is connected and the user selects the “sync” feature. This creates an opening which could potentially allow a hacker to take complete control over the device.

The first issue manifests like this: With the “sync” setting enabled, the device owner has access to both that device and a paired iPhone over a wireless connection, even after the device is disconnected from the syncing service. That sets up part one.

Part two of the first scenario requires a bit of social engineering, where a hacker tries to trick the device owner to click on a malicious link that will install malware of the hacker’s choosing on the vulnerable system.

The second part of the second scenario targets users who are traveling. A hacker could take control of a free airport charging station. In order to make use of those free charging stations, users are required to trust the device. As soon as that happens, the hacker controlling the charging station can remotely issue a command to connect to iTunes, and then enable the sync command.

Once those two steps are completed, even when the victim disconnects from the charging station, the hacker can still access the compromised device remotely, gaining access to most (if not all) of the user’s private information.

Unlike similar, recently discovered vulnerabilities in Apple products, this one distinguishes itself by allowing the hacker permanent access to the device, making it a dangerous vulnerability indeed.

Joseph Martin

President & CEO
I hope you enjoyed this article. My mission is to take your stress away from dealing with IT problems. Call (252) 565-1235 or send me a message at our contact us page if you have a question, comment or want help.

Bank Employee Steals Info On Over A Million Customers

May 5, 2018 by Joseph Martin

Atlanta-based SunTrust Bank is the 12th largest bank in the US. They have a major problem, and so do roughly a million and a half of its customers. According to CEO William Rogers, an unidentified employee of the firm printed a vast amount of private customer information, including their names, addresses, phone numbers and account balance information.

Rogers stressed that social security numbers, account numbers, driver’s license numbers, user IDs, and passwords were not exposed. In a recent press release, he had the following to say:

“In conjunction with law enforcement, we discovered that a former employee while employed at SunTrust may have attempted to print information on approximately 1.5 million clients and share this information with a criminal third party.

We and third parties have done forensic analysis on these accounts and we have not identified significant fraudulent activity regarding the effect of the accounts.”

Even so, this is a blow to the company’s image, and the lost trust won’t be easily regained. It also underscores how vulnerable companies are to internal threats.

In response to the attack, SunTrust is offering ongoing IDnotify identity protection (offered through Experian) to all its current and new clients at no cost.

The company’s handling of the issue so far has been about as good as can be expected. The unfortunate reality is that there aren’t many good ways of stopping a rogue employee from making off with sensitive customer data or proprietary company information. Better auditing protocols and controls can help, but only to a certain extent. While those kinds of policies make it easier to detect when an internal theft has occurred, they do nothing to actually prevent them.

This puts management in a tricky spot. Employees have to be trusted with sensitive data in order to do their work, which also increases risk. There aren’t many good solutions here beyond better vetting of employees, but of course, that is by no means a magic bullet either.

Joseph Martin

Researchers Find Major Vulnerabilities In Banking Apps

May 3, 2018 by Joseph Martin

Do you do your banking online? If so, there’s bad news in the form of a report recently released by the security firm “Positive Technologies.”

The company tested a variety of websites using a proprietary tool they developed in-house, which scans websites for security flaws. While flaws were found across a wide range of industries, literally every banking site Positive Technologies tested was found to have serious security flaws.

The particulars varied from one bank to the next, but the security flaws included:

XML external entity errors

Arbitrary file reading and modification flaws

Expired or nonexistent SSL certificates

Poor or nonexistent encryption

Some banking websites were so flawed that a hacker could execute a ‘man in the middle’ attack and execute malicious code to infect the user’s machine. They could potentially make off with all their money and with more than enough information to steal their identity.

Some 80 percent of sites tested were found to be vulnerable to XSS (cross-site scripting) attacks.

Regardless of the specific vulnerability, the big, terrifying takeaway from the Positive Technologies report is simply this: Of the financial sites they tested, 100 percent of them were found to have vulnerabilities.

These are the people who are tasked with safeguarding your money, and they’re obviously not doing enough to keep their websites secure.

Firewalls and basic detection protocols are simply not enough. The hackers of the world have matured and gotten better at what they do, and security professionals simply haven’t been improving as quickly. This is the reason we’re seeing such a massive spike in high profile data breaches. The reason is that each year is a new, record-breaking year, beating out the one before, often by a wide margin.

Until that changes, everyone is at risk. Given how important the internet has become to international commerce and modern life, that’s simply unacceptable.

Joseph Martin

MyFitnessPal User Information Data Breach Affects 150 Million

April 9, 2018 by Joseph Martin

Another week, another high-profile data breach. This time, it’s Under Armour in the hot seat. Under Armour acquired the MyFitnessPal app back in February 2015, and the company recently announced that their new acquisition was hacked in late February 2018.

So far, the company is taking all steps we’ve come to see as usual in these circumstances. They’ve notified their user base about the scope and scale of the attack, which impacted a hefty 150 million users. In conjunction with the announcement of the event itself, they assured their users that the theft of data was limited to user names, email addresses and encrypted passwords.

Although the stolen passwords are encrypted with bcrypt (which is a highly secure solution), the company is still recommending that all of the app’s users change their passwords immediately, just to be safe. Under Armour also assures its MyFitnessPal users that no credit card information was exposed.

In a departure from the routine we’ve come to expect in situations like these, the company is also warning users to be aware that since their emails were stolen, they may be subject to phishing scams in an attempt to get more of their personal information.

That announcement, in part, reads as follows:

“Please note that the email from MyFitnessPal about this issue does not ask you to click on any links or contain attachments and does not request your personal data. If the email you received about this issue prompts you to click on a link, suggests you download an attachment, or asks you for information, the email was not sent by MyFitnessPal and may be an attempt to steal your personal data. Avoid clicking on links or downloading attachments from such suspicious emails.”

While Under Armour’s handling of the incident has been solid so far, one has to wonder how many more of these incidents we’ll see before companies start taking data security more seriously.

Joseph Martin

Beware Fake Craigslist Email Could Contain Ransomware

March 24, 2018 by Joseph Martin

If you post ads on Craigslist for short term employment, be aware that there’s a new malspam campaign that aims to distribute Sigma ransomware on the computers of unwary users.

By all outward appearances, the emails seem to come from Craigslist in response to ads posted in Craigslist’s “Gigs” section for short term employment. The emails will generally express interest in whatever job the user has posted and include a protected Word or RTF document which recipients will assume are resumes.

If the recipient enters the password to unlock the document, they’ll then be presented with a screen that asks them to enable the content in the document. Unfortunately, this is the step that dooms the user. The file isn’t a resume at all, but merely a delivery vehicle.

As soon as the content is enabled, the ransomware will be installed, the user’s files will be encrypted, and then will “helpfully” post a message explaining that the files have been encrypted, and explaining that to get access to them again, they’ll have to pay a $400 fee, which rises to $800 if the user waits longer than seven days to request the decryption key.

Unfortunately, there’s no known way to decrypt Sigma-encrypted files other than paying the ransom.

This is a new twist on a very old game. Even worse, it’s enjoying a relatively high success rate because people who post ads for short term employment on Craigslist expect to get responses from people they don’t know. They expect that those people will be sending resumes for review.

The “tell” is that when a potential employee sends you a resume, it’s almost certainly not going to be password protected. In this case, your best bet would be to reply to the sending and ask them to send you a non-protected resume if they’re genuinely interested in the job.

Joseph Martin

Another 2.4 Million Users Hacked In Equifax Breach

March 16, 2018 by Joseph Martin

It looks like it’s going to be another bad month for Equifax. The company just can’t seem to get out of its own way.

In 2017, the company announced a massive data breach that (it initially claimed) impacted some 140 million users. Several months after the official announcement, the company was forced to revise the number of impacted users upward, as the forensic investigation into the breach continued.

Now, the company has announced a further upward revision of 2.4 million, bringing the total number of impacted users to slightly more than 148 million.

Equifax CEO Paulino do Rego Barros Jr. had this to say about the announcement, which raised more than a few eyebrows:

“This is not about newly discovered stolen data. It’s about sifting through the previously identified stolen data, analyzing other information in our databases that was not taken by the attackers, making connections that enabled us to identify additional individuals.”

As it did originally, the company has also announced that it would notify the newly identified consumers and offer them free credit monitoring and identity theft protection at no cost.

After last year’s congressional hearings on the matter, this portion of the announcement tends to illicit eyerolls. The company is in the credit monitoring business, and the way the company offers its “free” protection is that at the end of the free period, it automatically rolls into a paid plan unless the user cancels the service.

Of course, as with most such schemes, a high percentage of users won’t think about it until they get their first bill. One of the more acidic comments made during last year’s hearings was that the company actually seems to be profiting from their own data breach. That makes the CEO’s statement that “We are committed to regaining the trust of consumers, improving transparency, and enhancing security across our network” ring a bit hollow.

Joseph Martin

Mi-Cam Baby Monitor Video Feeds Vulnerable To Hacking

March 14, 2018 by Joseph Martin

Do you have a Mi-Cam in your home? Even if you don’t have kids, you may have one. They’re a highly popular, inexpensive means of keeping tabs on the comings and goings inside your home when you’re not around.

As with so many such devices these days, users have the option of installing either an Android or iOS app on their phones so they can peek in remotely, any time they like, and therein lies the problem.

It’s no secret that the IoT is filled with “smart” devices that don’t live up to their name when it comes to security, and the Mi-Cam is no exception. Security researchers have discovered that the communications between the company’s cloud servers where the video feeds live and the smartphones of the product’s user based are not secure.

So far, six different vulnerabilities have been identified, all of them critical. Any one of them would allow a hacker to hijack the window into your video feed and use that to scroll through literally every video feed on the company’s cloud, regardless of who owns it. All told, that’s more than fifty thousand video feeds, accessible from a single point of entry.

It gets worse. The attack is trivial to perform, because no SSL certificate is needed. All that’s required is a copy of either the Android or iOS mobile app.

The manufacturer of the Mi-Cam has been notified of these critical security flaws, but as of now, none have been addressed. The company has not released any information about when they might be. In light of that, if you have one, your best bet is to simply stop using it until the company can at least employ some rudimentary security protocols.

Joseph Martin

IRS Labeled Email Could Contain Ransomware

March 5, 2018 by Joseph Martin

There’s a new strain of the “Rapid Ransomware” making the rounds, and because of how it’s being transmitted, it’s destined to have a higher than average rate of infection. The new strain was first discovered by Derek Knight. It is disturbing because it claims to come from the IRS, and will feature subject lines like “IRS Urgent Message-164.”

The body of the email then goes on to say that the recipient owes some amount of money in real estate taxes, and “helpfully” includes instructions for how to settle in the attached file. Inside the zipped file, the user will find a word document. You’ll need to click on “Enable Editing” to see the file, and unfortunately, the moment you do, you’re doomed. “Rapid” will scan the target computer for data files and encrypt them, appending each with the “.rapid” extension.

As soon as the malware finishes encrypting your files, it will automatically open “Recovery.txt” which will display details on how much you’ll have to pay the hackers to get your files back. Unlike most other ransomware strains, this one will configure itself to start every time you login to the computer, so if you pay the ransom to get access to your files again, but fail to completely remove the malware, you’ll be facing the same problem the very next time you use the machine.

Observant users will take note of the fact that the email address is not a .gov and likely not be taken in. Unfortunately, many people will look no further than the subject line and immediately begin following the instructions contained in the email, which is obviously the reaction that the hackers are hoping for.

As ever, protecting yourself from threats like these comes down to two things: Education and vigilance.

Joseph Martin

Almost Half Of Top Ranking Websites Are Vulnerable

February 20, 2018 by Joseph Martin

Menlo Security just released their third annual “State of the Web” report and it’s not pretty. The headline finding is that 42% of the top 100,000 sites as ranked by Alexa are more dangerous than you think.

The report defines a risky site as one that meets one of three criteria:

The site, or one of its associated background sites (from which news articles or video is pulled), is running software with a known security vulnerability

The site has been used to launch attacks or distribute malware

The site has suffered a security breach in the past twelve months

This first point is key, and often overlooked by security professionals. Any time your website is pulling content from another source, it creates an opening that a hacker could potentially exploit. Worse, most security professionals lack the tools to properly monitor those connections.

As bad as that sounds, there’s an even worse detail lurking in the pages of the report, and that concerns emails.

Hackers are increasingly moving away from setting up their own domains. Instead, they’re preferring to create a subdomain of a compromised, legitimate domain, which makes it harder to spot. Amir Ben-Efraim, the CEO of Menlo Security, had this to say about the issue:

“It is far easier to set up a subdomain on a legitimate hosting service than use other alternatives – such as trying to hack a popular, well-defended site or to set up a brand-new domain and use it until it is blocked by web security firms. Legitimate domains are often whitelisted by companies and other organizations out of a false sense of security, giving cover to phishing sites.

Also, hosting services typically allow customers to set up multiple subdomains. For example, researchers found 15 phishing sites hosted on the world’s 10 most popular domains.”

The bottom line is: The web and even the most popular sites on it, aren’t nearly as safe as you think.

Joseph Martin

Use Of Bots Has Increased Fake Account Creations

February 1, 2018 by Joseph Martin

The ThreatMetrix Cybercrime Report 2017 is out, and is a troubling read for anyone who has anything to do with data security. As a fraud prevention company protecting nearly a billion and a half users around the world, they’re uniquely positioned to know, and their insights on the threat landscape is invaluable.

Their main finding is that hackers, scammers and fraudsters are moving away from using stolen debit and credit cards, given that these things have such a short shelf life. On the face of it, that sounds like it might be a good thing, until you understand what they’re doing instead.

They’re making use of stolen identity data to create bogus accounts, then applying for lines of credit on their own. Even worse, they’re taking full advantage of automation to speed the process along. According to the report, the volume of global fraud attacks is up a mind blowing 100 percent in just two years, with 700 million incidents reported in 2017 alone.

Bots are coming to play an increasingly important role in the activity of the fraudsters, too. Once a new, fraudulent account has been created, it’s handed off to a bot to test it and make sure it’s valid, which increases its value on the Dark Web.

How big of a problem are bots on the web these days?

According to the report, ThreatMetrix blocked 1.5 billion bot attacks last year, with some retailers reporting that more than 90% of their daily traffic is comprised of bots.

At the root, what’s driving this behavior are the increasingly common, large-scale data breaches that put up to hundreds of millions of data records into the hands of fraudsters. Until and unless the flow of data can be stopped, we can expect this type of activity to continue to increase.

No matter how you slice it, 2018 is going to be a very interesting and very busy year.

Joseph Martin

WiFi Sync on iOS Vulnerable To TrustJacking

Bank Employee Steals Info On Over A Million Customers

Researchers Find Major Vulnerabilities In Banking Apps

MyFitnessPal User Information Data Breach Affects 150 Million

Beware Fake Craigslist Email Could Contain Ransomware

Another 2.4 Million Users Hacked In Equifax Breach

Mi-Cam Baby Monitor Video Feeds Vulnerable To Hacking

IRS Labeled Email Could Contain Ransomware

Almost Half Of Top Ranking Websites Are Vulnerable

Use Of Bots Has Increased Fake Account Creations

Contact Info

Navigation