Popular Chrome Ad Blocker Faked, 30k Users Infected With Malware

November 3, 2017 by Joseph Martin

“Fool me once, shame on you. Fool me twice, shame on me,” as the saying goes. Unfortunately, Google has now been fooled by the same trick twice.

For the second time in recent years, Google has allowed a malicious variant of the popular extension “AdBlock Plus” onto its Chrome Web Store. It was noticed by a security researcher going by the alias “SwiftOnSecurity.” Before Google removed it, it had been installed more than 37,000 times by unsuspecting users.

This incident underscores a serious flaw in the way that Chrome extensions are uploaded to the Web Store.

The entire process is automated, and Google only intervenes if an extension is reported as being problematic. Unfortunately, given the automated nature of the process, it’s almost frighteningly easy to abuse, and since there are no significant checks on the front end, hackers can upload extensions bearing the same or highly similar names as extensions from legitimate developers. Unless a user clicks on the “reviews” tab to read what other users are saying about the extension, at first glance, they’d have no real way of knowing that there was a problem until they started experiencing it for themselves.

As mentioned, this is actually the second time this very extension was abused, the first being back in 2015.

As malware goes, this one is annoying, but not awful. Instead of blocking ads, it has a tendency to open multiple new windows, displaying a torrent of unwanted advertising. Fortunately, there don’t seem to be any other “hooks” built into the code, so it doesn’t install more destructive malware, but it’s still annoying.

All that to say, if you’ve been experiencing a sudden flurry of advertising popups, you may have been one of the unlucky few to have grabbed a malicious variant of an otherwise excellent web extension. If you have, just uninstall it and go grab a new copy, and you should be all set.

Joseph Martin

President & CEO
I hope you enjoyed this article. My mission is to take your stress away from dealing with IT problems. Call (252) 565-1235 or send me a message at our contact us page if you have a question, comment or want help.

New Hack Attempts To Access Office 365 Passwords

November 2, 2017 by Joseph Martin

Companies are getting better at detecting and fending off brute force attacks. Depending on how big, and how hard-hitting the attack is, it can still get through, of course, but the main problem with such an attack is that it’s impossible to miss. The moment it starts, security professionals know what’s going on, and can immediately spring into action.

Of course, the hackers know this, and have been looking for ways around the problem. How can they launch an attack that will go unnoticed?

Now, it seems that they have a viable answer: low and slow.

It requires patience. Rather than hitting hard and all at once, this new attack vector utilizes a small number of machines and a low attack frequency in order to stay under the radar. Often, the hackers orchestrating such attacks will spread them out over weeks, or even months, and alternate between several different companies on the thinking that if it doesn’t trigger any alarms, then the security folks won’t go on high alert, and they can keep chipping away until they get lucky and break in.

While it hasn’t worked so far, the new approach did manage to go unnoticed for a number of months before the pattern was detected by SkyHigh Security.

The attack they discovered is an especially clever one. It has been going on since May, and it seeks to target email accounts not controlled by individuals, but used to fulfill other corporate functions. These are things like service automation, marketing and other system accounts.

The reason? Most of these don’t use two-factor authentication, and most people who check those types of accounts don’t expect to see malicious emails in those inboxes, and are thus more likely to click on embedded links, even if sent by accounts that are unrecognized.

Nothing is currently known about the group behind the attacks. They are focused on high-value targets in the financial services and medical fields and attempted to gain access to Office 365 accounts, which would give them access to a wealth of sensitive corporate information.

Although there’s no evidence that the attack has succeeded to this point, it is as clever as it is insidious, and definitely something to be aware of. From a practical standpoint, the strongest defensive move you can make is to be sure that all of the aforementioned types of email accounts are using two-factor authentication.

Joseph Martin

OnePlus Mobile Phone Found To Be Collecting User Data

November 1, 2017 by Joseph Martin

If you own a smartphone made by Chinese manufacturer OnePlus, you can thank security researcher Chris Moore for making a discovery that the manufacturer wasn’t going to tell you about.

It turns out that OnePlus phones running the OxygenOS are recording a disturbing amount of user data and sending it back to a company server. The data being collected on users include, but are not limited to:

• Any time the user locks or unlocks the phone

• Any time the user launches, uses or closes an app

• Which WiFi networks the device connects to

• The phone’s IMEI

• The phone number tied to the phone

• Mobile network names

All of this makes it very easy for the company to personally identify users.

When Moore was conducting his tests, he noted that the phone sent more than 16MB of data back to the server in a span of just ten hours. If you’re on a data plan with tight limits, that could max out your usage in no time.

The company issued a response to the findings, confirming that it does indeed transmit analytic data to an Amazon server in two distinct streams, one designed to help them fine-tune their software and the second for sale support, but insists that nothing nefarious is going on. They further stress that users can turn off some of the data collection by going into Settings  Advanced, and then deselect the option to “Join The User Experience Program” which is set to active by default.

Unfortunately, this only deactivates the first of the two data streams. It is apparently impossible to deactivate the second.

The company’s official explanation seems a bit thin, but unfortunately, there’s little to be done. While you can limit the amount of data collected on you, at this time, there’s no way to stop it completely. Keep this in mind if you use a OnePlus phone.

Joseph Martin

2012 Disqus Hack Exposed More Than 17 Million Users

October 30, 2017 by Joseph Martin

The hits just keep coming, with Disqus being the latest company to issue a breach disclosure. If you’ve never heard of it, Disqus is an incredibly popular, plugin-based comment service for blogs.

Although the breach was only just discovered, it occurred five years ago in July 2012 and impacted more than 17.5 million users.

Evidence of the breach was initially discovered by an independent security researcher named Troy Hunt. It was then reported to the company and disclosed 24 hours later by Jason Yan, the CTO of the company, who had this to say:

“No plain text passwords were exposed, but it is possible for this data to be decrypted (even if unlikely). As a security precaution, we have reset the passwords for all affected users. We recommend that all users change passwords on other services if they are shared.”

Mr. Yan’s advice is excellent, but unfortunately, it highlights a persistent, ongoing problem. Far too many people are still in the habit of using the same password across multiple websites, which means that when one site is breached, it potentially gives the hackers access to all your other accounts that have passwords in common.

It should be noted that since the breach, Disqus has made several upgrades to their security, including implementing even more robust encryption than they’d formerly been using. Again, per Mr. Yan:

“Since 2012, as part of normal security enhancements, we have made significant upgrades to our database and encryption to prevent breaches and increase password security. Specifically, at the end of 2012, we changed our password hashing algorithm from SHA1 to bcrypt.”

The problem is solved for now, but the damage has been done. The best thing you can do at this point is change your password immediately, stop using the same password across multiple websites and be on the alert for phishing emails designed to get you to give up even more information.

Joseph Martin

The IRS Awards Security Contract To Equifax Even After Hack

October 26, 2017 by Joseph Martin

You’ve probably heard about Equifax’s recent troubles. More than 145 million consumer data files were exposed, including names, addresses, social security numbers and more.

The problem was viewed as so serious that Equifax’s CEO stepped down and congressional hearings were launched, but then, a funny thing happened. Equifax got awarded a no-bid government contract worth millions ($7.25 million, to be exact) to help the IRS verify taxpayer identities in order to prevent fraud.

One might wonder how this happened, especially since the company recently got raked over the coals for profiting from the very hack they tried to prevent. During the congressional hearing on the matter, Senator Elizabeth Warren pointed out that Equifax stood to make millions by selling credit monitoring services to the very customers whose data they were supposed to be protecting, so it’s a fair question.

The answer lies in the fact that the IRS regards this service as being critical, and one that cannot stand interruption of any kind. Based on their research, they have concluded that Equifax is the only company capable of providing it.

That conclusion seems strange, given that there are, in fact, two other similar credit reporting agencies, but in any case, the contract was awarded to Equifax in spite of their recent troubles.

The move is understandably raising eyebrows in various sectors, with government watchdog groups and privacy advocates both crying foul.

Unfortunately, in the immediacy, there’s little to be done. This is a case where the wheels of government just don’t turn quickly enough to keep pace with current events. Until another company can be approved to get the job done, Equifax is the only game in town, as far as the government is concerned. Needless to say, this is not exactly what one would call confidence-inspiring.

Joseph Martin

Sonic Drive-In Latest Company With Credit Card Breach

October 24, 2017 by Joseph Martin

Another week, another data breach, and this time, popular fast food chain Sonic found itself in the crosshairs.

The breach came to light when a Brian Krebs, a journalist for Infosec, spotted a large batch of credit card data for sale on an underground website.

IBM’s “X-Force” division confirmed Krebs’ findings, and later that same day, Sonic confirmed the report, offering all of its customers two years of free fraud and identity theft protection.

At this point, the company has released no details on how many of their 3600 locations were impacted, or how many customers might have been affected. However, Krebs noted that the cache he saw contained some five million records, which at least gives us some indication as to the scope and scale of the attack.

Given the relative lack of information about the incident so far, the best thing you can do if you frequent any Sonic location is to monitor your credit and debit card statements closely and take advantage of the free credit monitoring service offered.

It’s no great surprise why hackers are so interested in credit card data. Each record sells for between $25 and $50, so that cache of five million records represents a significant payday.

The fear, as pointed out by numerous security experts of late, is that given how easy it has been for hackers to breach company POS systems, the hackers will up the ante and begin introducing ransomware to the payloads they install on these systems.

Without a functioning POS system, business grinds to a complete halt, so the thinking is that most businesses facing this kind of attack would pay the ransom immediately, making the hackers’ payday even sweeter.

While this type of attack hasn’t been seen yet, most experts agree that it’s just a matter of time, making it one more thing to worry about. This is all the more reason to make sure your own POS terminals are as secure as you can possibly make them. You definitely don’t want to be next!

Joseph Martin

Firefox Will End Support For XP, and Vista Users In 2018

October 21, 2017 by Joseph Martin

Microsoft stopped supporting Windows XP and Vista quite some time ago., Butbut so far, Firefox has been hanging tough, continuing to provide updates to their browser’s users on both platforms, doing at least something to extend their useful life a bit longer.

That’s soon coming to an end going to change soon. Mozilla recently announced that as of June 2018, their support for both XP and Vista would be coming to an end.

Originally, Mozilla planned to discontinue support to both XP and Vista in December 2016. That date came and went, and the company announced that they’d provide a revised date for ending their support no later than September 2017. They’ve now settled on a final date, and odds are that the two platforms won’t get another extension beyond this.

If you’re still using either XP or Vista, it’s well past time to migrate or upgrade. Unfortunately, tens of millions of users around the world are still clinging to these systems, because the legacy software running on them simply isn’t compatible with more modern operating systems.

The danger, though, is that sans security patches, these systems are growing increasingly vulnerable to hacking attacks as time passes. New security flaws and exploits are being discovered all the time, and they’re not getting patched, making these old systems little more than ticking time bombs on your company’s network.

All that to say, if you’re still struggling to upgrade your legacy systems so you can finally move away from Windows Vista and XP, it’s more important than ever. No matter how important those legacy systems are to your company, the hard truth is that the longer those old systems remain connected to your network, the more danger your company is in. It’s not a question of if a hacker will exploit that system, it’s a matter of when.

The clock is ticking.

Joseph Martin

Even Minimal Exposure Can Result In Huge Fines

October 19, 2017 by Joseph Martin

Data security is no laughing matter, and even small exposures can lead to hefty fines, no matter the size of your company.

Last year, the federal government sent shockwaves through the industry when they began an aggressive campaign of investigating and punishing companies for HIPAA infractions, logging more than a dozen high profile settlements.

While it’s true that this particular case did not involve a HIPAA violation, it has much in common with the hefty fines the federal government has been levying as of late for even small HIPAA infractions. This particular incident revolved around a spreadsheet which contained personal data on 660 ACA enrollees in the state of Vermont.

The spreadsheet was on a remote server managed by Samanage USA, a small North Carolina-based IT support service, and was improperly secured, allowing for unauthorized access to it.

As it happened, one of the people on the spreadsheet was doing a Google search of her own name and came across the entry in a search result. When she saw it, she immediately notified the state’s Attorney General, which prompted a formal investigation.

The search result was traced back to Amazon’s Web Services platform, and then to Samanage. An Amazon engineer emailed Samanage to inform them that it had PII improperly secured and publicly accessible, and asked them to remove it.

Samanage began an investigation of their own, found the problem and promptly corrected it, but failed to inform their client company, WEX Health about the breach.

Ultimately, this is what got Samanage in trouble. According to the settlement, the $264,000 fine was levied specifically for not notifying the proper authorities that the breach had occurred, which, under Vermont state law, included WEX Health.

The reason that this was not seen as a HIPAA breach was that Samanage was a subcontractor for the information services provider to a health plan offered through the ACA’s marketplace. As such, they were designated as a non-covered entity where HIPAA privacy, security, and breach notification rules were concerned.

Imagine how much bigger the fine would have been if they had been in violation. A sobering thought indeed.

Joseph Martin

WiFi Security Flaw Affects Millions Of Users And Devices

October 18, 2017 by Joseph Martin Leave a Comment

Security researchers have found a new critical security flaw dubbed “Krack” (Key Reinstallation Attacks) that affects literally every WiFi router and smart phone in use today. The reason? The security flaw resides in the WiFi standard itself, rather than in a third-party product.

In addition to being vast in scope and scale, Krack is a particularly nasty, versatile flaw, allowing hackers to intercept credit card numbers, passwords, photos and a whole host of sensitive personal information.

It works like this: A hacker finds a vulnerable WPA2 network, and then makes an exact copy of it, including impersonating the MAC address. This clone then serves as a “man in the middle” allowing the hacker who controls it to intercept everything passing through it.

WPA2 encryption requires a unique key to encrypt each block of plain text, but because Krack attacks make a copy that’s indistinguishable from the original, they’re able to use the same encryption key.

As bad as that is, it gets worse for Android and Linux users. Thanks to a bug in the WPA2 standard, these devices don’t force the client to demand a unique encryption key with each use. Instead, they allow the key to be “zeroed out,” literally creating an encryption key containing all zeroes, which interferes with a key part of the handshake process.

In addition to that, hackers can deploy specialized scripts that can cause the connection to bypass HTTPS, which leaves passwords and other normally protected data exposed.

If there’s a silver lining, it is that the attack can’t be used to target routers directly, but honestly, that’s not much of a silver lining, because the potential damage this new vector could cause is virtually without limit.

Unfortunately, until a patch is released, there’s not much you can do, short of turning off WiFi altogether. This may work for smartphone users, but it is simply impractical for routers.

There’s some good news, though. The fix should be relatively easy to implement, although no ETA has been given at this point.

More Info At: https://www.krackattacks.com

Joseph Martin

Not Monitoring Internet Usage Could Be Risky Business

October 9, 2017 by Joseph Martin

A Big Part of Your Business Can Cause Big Problems

The internet and email are tools we use in business so fluently we can’t imagine the world without them. However, more and more businesses are discovering that these tools are being used by employees for activities that aren’t business related. Employers are quickly discovering that unmonitored internet use by employees is severely hampering productivity and can even result in serious legal consequences.

In order to reduce or even eliminate these risks, there are two key approaches every business must take. The first is to establish a detailed Internet Acceptable Use Policy or IAUP to set clear guidelines for employees on what is and is not appropriate use of email and the internet. The second step is the installation of a monitoring system for your business network that ensures employees are operating under the IAUP guidelines.

When establishing your IAUP, you want to be sure you specifically outline prohibited uses, rules for online behavior, access privileges and penalties for violations of the company policy that include consequences for security violations and vandalism of the system.

Common Flaws Found in IAUPs

Instant Messaging – While instant messaging services are a quick and easy way to communicate within the office, you must be cautious about what you’re sending. A majority of IM services don’t provide adequate security measures for confidential data and information.
Social Media – As the popularity of social media continues to grow, so does the risk of confidential company and client information being leaked to it. You don’t want to see the latest company gossip or scandal spreading across Facebook like wildfire.
Websites – Strictly prohibit employees visiting websites that contain pornography, racism, sexism, gambling or emailing any of this content. Even if the intention is innocent, the consequences won’t be.
Downloading – Put a strict halt to all downloading when it comes to music, video, programs and apps. These downloads could easily contain viruses that will quickly put your data at risk and result in a costly cleanup.

Joseph Martin

Popular Chrome Ad Blocker Faked, 30k Users Infected With Malware

New Hack Attempts To Access Office 365 Passwords

OnePlus Mobile Phone Found To Be Collecting User Data

2012 Disqus Hack Exposed More Than 17 Million Users

The IRS Awards Security Contract To Equifax Even After Hack

Sonic Drive-In Latest Company With Credit Card Breach

Firefox Will End Support For XP, and Vista Users In 2018

Even Minimal Exposure Can Result In Huge Fines

WiFi Security Flaw Affects Millions Of Users And Devices

Contact Info

Navigation