Blog – Page 30

Watch Out For New Facebook “Trusted Friend” Scam

November 9, 2017 by Joseph Martin

If you can’t trust your friends, who can you trust?

No one, apparently.

There’s a new scam on Facebook that’s making waves, and it’s one you should be mindful of. You may get an “urgent message” from someone you know, asking for your help in recovering their Facebook account.

This is a tried and true phishing scam, relying on some basic psychology. After all, if you get an earnest sounding message from someone you know explaining that you’re listed as one of their “Trusted Friends” and as such, uniquely positioned to help verify their identity so they can get access to their account back, who wouldn’t instinctively respond? This is exactly what the scammers are hoping for.

The message goes on to explain that they’re sending an unlock code to your email address, and they just want you to reset the password for them.

Unfortunately, the unlock code is nothing of the sort. Instead, it triggers a password reset for your own account. If you click the link and “reset your friend’s password,” then reply back, helpfully telling him or her what the new password is, you’ve inadvertently given your own login information to the hackers. From there, the sky’s the limit.

What makes this latest scam particularly problematic is that so many other web properties allow you to use your Facebook login details to access them, which is a roundabout way of saying that you’re using the same login credentials across multiple websites – one of the most basic and pervasive problems of user security in existence.

There’s no real defense for this other than vigilance, and if you see a message like this, simply ignore it. If your “trusted friend” genuinely needs help regaining control of their account, Facebook has resources to assist.

Joseph Martin

President & CEO
I hope you enjoyed this article. My mission is to take your stress away from dealing with IT problems. Call (252) 565-1235 or send me a message at our contact us page if you have a question, comment or want help.

Top Subject People Fall Victim To Is – Data Breach Notification

November 8, 2017 by Joseph Martin

For hackers around the world, success breeds more success, it seems.

A company called KnowBe4 has released a report entitled “Top Ten Global Phishing Email Subject Lines For Q3 2017.” To prepare it, they analyzed email subject lines from simulated phishing tests to determine what the most effective approach was.

Their findings were that “Official Data Breach Notification” was the hands-down winner, generating far more click-throughs than any other.

Perry Carpenter, KnowBe4’s Chief Evangelist, and Strategy Officer had this to say about the report:

“Phishing attacks are responsible for more than 90% of successful cyber-attacks and the level of sophistication hackers are now using makes it nearly impossible for a piece of technology to keep an organization protected against social engineering threats.

We see urgency and fear of a breach as the drivers. We have over 1400 templates and a concentration of themes so we know what is highly effective. Phishing attacks are smart, personalized and timed to match topical news cycles. Businesses have a responsibility to their employees, their shareholders, and their clients to prevent phishing schemes.”

Wise words and the first step on the path to prevention is knowing what triggers are the most effective, which makes the KnowBe4 report especially valuable to data security teams, regardless of what business your company is in.

The irony, however, is inescapable.

The reason that “Official Data Breach Notification” is such a devastatingly effective phishing headline is simply that the hackers have been devastatingly effective. Barely a day goes by that we are not greeted by some grim headline and a news story recounting the woes of yet another company suffering from yet another massive breach resulting in hundreds of thousands, millions, or more consumer data files stolen.

They are, in a very real sense, leveraging the power of their own success to become even more successful, and that’s sadly not likely to change anytime soon.

Joseph Martin

Ransomware Continues To Evolve On Android Devices

November 6, 2017 by Joseph Martin

Hackers around the world are continuing to innovate at a terrifying, relentless pace, and that truth is reflected in the latest form of ransomware to be found in the wild.

Dubbed “DoubleLocker,” this new strain targets Android devices. It uses and abuses the platform’s Accessibility Service, reactivating itself every time the user presses the phone’s “Home” button.

Initial forensic analysis of the code base reveals this new threat to be based on Svpeng, which is a nasty form of malware that has a rather infamous reputation among Android users. It is one of the best-known banking trojans on the platform, used to steal money from people’s bank accounts, change PINs, brick devices, and demand ransoms to return them to operability.

Although DoubleLocker does not contain Svpeng’s banking hack features, it is a very advanced, highly sophisticated piece of code.

As with so many other malicious programs, it gains an initial foothold on the user’s machine by disguising itself as some other, perfectly legitimate program (most often, Flash Player). Once installed, if the user grants the app access, Android’s Accessibility service allows the app to mimic user screen taps and swipes, allowing it to navigate around on the user’s phone.

It immediately locks the user’s PIN with a ransom PIN code and encrypts all files on the device.

This is the most significant development, because previous to finding DoubleLocker in the wild, most other Android ransomware worked by simply locking the user’s phone. This one takes cues from PC-based ransomware and takes the added step of encrypting the files themselves.

Another intriguing difference is that while most ransomware is configured to send the user an unlock code once the ransom is paid, no such code is sent to a user infected by DoubleLocker. Instead, the hackers unlock the phone remotely, upon receiving payment.

For users impacted by DoubleLocker, the following advice has been offered by ESET:

“The only viable option to clean the device of the DoubleLocker ransomware is via a factory reset.

For rooted devices, however, there is a method to get past the PIN lock without a factory reset. For the method to work the device needed to be in the debugging mode before the ransomware got activated.

If this condition is met, then the user can connect to the device by ADB and remove the system file where the PIN is stored by Android. This operation unlocks the screen so that the user can access their device. Then, working in safe mode, the user can deactivate device admin rights for the malware and uninstall it. In some cases, a reboot is needed. As for data stored on the device, there is no way to recover it, as mentioned earlier.”

Joseph Martin

Hard Drives Susceptible To Sound Waves, Can Double As Microphones

November 5, 2017 by Joseph Martin

File this one away under â€œobscure and terrifying.â€�

Recently, a security researcher named Alfredo Ortega, speaking at a security conference in Buenos Aires, unveiled research revealing that the hard drive in your computer can be, with a bit of work, turned into a rudimentary microphone and used to spy on you.

It should be noted that this hack only works on HDDs and takes advantage of the way they are designed. Understand that this isnâ€™t a flaw; itâ€™s simply the way the technology works.

An HDD cannot be read or written to if it is subject to vibration. Your machine has to wait for the oscillation to stop before it can perform an action. Modern OSs come with built-in tools that measure HDD operations to the nanosecond, and herein lies the secret of Ortegaâ€™s discovery.

The longer the delay, the louder the sound, and the more intense the vibration, which leads to longer delays in the read-write function of the drive.

Knowing this, Ortega figured that it would be possible to work backward and reconstruct the sound that caused the vibration on the HDD platters.

He was at least partially correct. While his reverse engineering technology is not yet sufficiently developed to pick up conversations, he notes that there is research that can recover voice data from very low-quality signals using pattern recognition. He figures that itâ€™s just a matter of time before someone applies it to his research.

Per Mr. Ortega: â€œI didnâ€™t have time to replicate the pattern-recognition portion of that research into mine. However, itâ€™s certainly applicable. For that reason, I would not discard that additional data like voice could be recovered in the future.â€�

It’s not something to be worried about immediately, but the dayâ€™s coming when your own hard drive could be used against you.

Joseph Martin

After Yet Another Equifax Hack, IRS Suspends Contract Worth $7.5M

November 4, 2017 by Joseph Martin

Equifax just can’t seem to get out of its own way.

Not long ago, the company suffered a massive data breach which saw the sensitive information of more than 145 million consumers exposed.

As a result, congressional hearings were convened, and the CEO resigned in disgrace. Amazingly, though, despite these events, the IRS opted to award the company a contract worth $7.5 million for its help and expertise in verifying taxpayer identification to prevent identity theft.

The irony did not escape the notice of security professionals around the world, who wrote literally hundreds of Op-ed and protest pieces.

Then, Equifax got hacked again. The company’s website was found to have been hacked, redirecting users to a malicious site that sent them to download adware.

Almost as soon as the issue was discovered, Equifax took the page down, insisting that this latest hack was due to a third-party contractor and did not constitute another breach of their network. However, that explanation was insufficient to the IRS, which suspended the recently awarded contract in response.

The decision has a real and immediate impact on the nation’s taxpayers because it will prevent them from creating new accounts through the IRS’s “Secure Access” program, which provides taxpayer access to transcripts and other records. If you already have an account set up, you will not be impacted.

The decision to pull the contract was seen as a positive development by the congressional committee convened to hold hearings on the matter, which concluded that, given the company’s recent track record, there was no real way to argue that this somehow increased user security.

On the other hand, as was pointed out by IRS Commissioner John Koskinen, the move would prevent literally thousands of recent hurricane victims from accessing their tax information.

Both points are true, but it’s hard to see how it could be argued that pulling the contract was the wrong move, even if it temporarily inconveniences a small percentage of taxpayers.

Joseph Martin

Popular Chrome Ad Blocker Faked, 30k Users Infected With Malware

November 3, 2017 by Joseph Martin

“Fool me once, shame on you. Fool me twice, shame on me,” as the saying goes. Unfortunately, Google has now been fooled by the same trick twice.

For the second time in recent years, Google has allowed a malicious variant of the popular extension “AdBlock Plus” onto its Chrome Web Store. It was noticed by a security researcher going by the alias “SwiftOnSecurity.” Before Google removed it, it had been installed more than 37,000 times by unsuspecting users.

This incident underscores a serious flaw in the way that Chrome extensions are uploaded to the Web Store.

The entire process is automated, and Google only intervenes if an extension is reported as being problematic. Unfortunately, given the automated nature of the process, it’s almost frighteningly easy to abuse, and since there are no significant checks on the front end, hackers can upload extensions bearing the same or highly similar names as extensions from legitimate developers. Unless a user clicks on the “reviews” tab to read what other users are saying about the extension, at first glance, they’d have no real way of knowing that there was a problem until they started experiencing it for themselves.

As mentioned, this is actually the second time this very extension was abused, the first being back in 2015.

As malware goes, this one is annoying, but not awful. Instead of blocking ads, it has a tendency to open multiple new windows, displaying a torrent of unwanted advertising. Fortunately, there don’t seem to be any other “hooks” built into the code, so it doesn’t install more destructive malware, but it’s still annoying.

All that to say, if you’ve been experiencing a sudden flurry of advertising popups, you may have been one of the unlucky few to have grabbed a malicious variant of an otherwise excellent web extension. If you have, just uninstall it and go grab a new copy, and you should be all set.

Joseph Martin

New Hack Attempts To Access Office 365 Passwords

November 2, 2017 by Joseph Martin

Companies are getting better at detecting and fending off brute force attacks. Depending on how big, and how hard-hitting the attack is, it can still get through, of course, but the main problem with such an attack is that it’s impossible to miss. The moment it starts, security professionals know what’s going on, and can immediately spring into action.

Of course, the hackers know this, and have been looking for ways around the problem. How can they launch an attack that will go unnoticed?

Now, it seems that they have a viable answer: low and slow.

It requires patience. Rather than hitting hard and all at once, this new attack vector utilizes a small number of machines and a low attack frequency in order to stay under the radar. Often, the hackers orchestrating such attacks will spread them out over weeks, or even months, and alternate between several different companies on the thinking that if it doesn’t trigger any alarms, then the security folks won’t go on high alert, and they can keep chipping away until they get lucky and break in.

While it hasn’t worked so far, the new approach did manage to go unnoticed for a number of months before the pattern was detected by SkyHigh Security.

The attack they discovered is an especially clever one. It has been going on since May, and it seeks to target email accounts not controlled by individuals, but used to fulfill other corporate functions. These are things like service automation, marketing and other system accounts.

The reason? Most of these don’t use two-factor authentication, and most people who check those types of accounts don’t expect to see malicious emails in those inboxes, and are thus more likely to click on embedded links, even if sent by accounts that are unrecognized.

Nothing is currently known about the group behind the attacks. They are focused on high-value targets in the financial services and medical fields and attempted to gain access to Office 365 accounts, which would give them access to a wealth of sensitive corporate information.

Although there’s no evidence that the attack has succeeded to this point, it is as clever as it is insidious, and definitely something to be aware of. From a practical standpoint, the strongest defensive move you can make is to be sure that all of the aforementioned types of email accounts are using two-factor authentication.

Joseph Martin

OnePlus Mobile Phone Found To Be Collecting User Data

November 1, 2017 by Joseph Martin

If you own a smartphone made by Chinese manufacturer OnePlus, you can thank security researcher Chris Moore for making a discovery that the manufacturer wasn’t going to tell you about.

It turns out that OnePlus phones running the OxygenOS are recording a disturbing amount of user data and sending it back to a company server. The data being collected on users include, but are not limited to:

• Any time the user locks or unlocks the phone

• Any time the user launches, uses or closes an app

• Which WiFi networks the device connects to

• The phone’s IMEI

• The phone number tied to the phone

• Mobile network names

All of this makes it very easy for the company to personally identify users.

When Moore was conducting his tests, he noted that the phone sent more than 16MB of data back to the server in a span of just ten hours. If you’re on a data plan with tight limits, that could max out your usage in no time.

The company issued a response to the findings, confirming that it does indeed transmit analytic data to an Amazon server in two distinct streams, one designed to help them fine-tune their software and the second for sale support, but insists that nothing nefarious is going on. They further stress that users can turn off some of the data collection by going into Settings  Advanced, and then deselect the option to “Join The User Experience Program” which is set to active by default.

Unfortunately, this only deactivates the first of the two data streams. It is apparently impossible to deactivate the second.

The company’s official explanation seems a bit thin, but unfortunately, there’s little to be done. While you can limit the amount of data collected on you, at this time, there’s no way to stop it completely. Keep this in mind if you use a OnePlus phone.

Joseph Martin

2012 Disqus Hack Exposed More Than 17 Million Users

October 30, 2017 by Joseph Martin

The hits just keep coming, with Disqus being the latest company to issue a breach disclosure. If you’ve never heard of it, Disqus is an incredibly popular, plugin-based comment service for blogs.

Although the breach was only just discovered, it occurred five years ago in July 2012 and impacted more than 17.5 million users.

Evidence of the breach was initially discovered by an independent security researcher named Troy Hunt. It was then reported to the company and disclosed 24 hours later by Jason Yan, the CTO of the company, who had this to say:

“No plain text passwords were exposed, but it is possible for this data to be decrypted (even if unlikely). As a security precaution, we have reset the passwords for all affected users. We recommend that all users change passwords on other services if they are shared.”

Mr. Yan’s advice is excellent, but unfortunately, it highlights a persistent, ongoing problem. Far too many people are still in the habit of using the same password across multiple websites, which means that when one site is breached, it potentially gives the hackers access to all your other accounts that have passwords in common.

It should be noted that since the breach, Disqus has made several upgrades to their security, including implementing even more robust encryption than they’d formerly been using. Again, per Mr. Yan:

“Since 2012, as part of normal security enhancements, we have made significant upgrades to our database and encryption to prevent breaches and increase password security. Specifically, at the end of 2012, we changed our password hashing algorithm from SHA1 to bcrypt.”

The problem is solved for now, but the damage has been done. The best thing you can do at this point is change your password immediately, stop using the same password across multiple websites and be on the alert for phishing emails designed to get you to give up even more information.

Joseph Martin

Microsoft Officially Pulls Plug On Windows Phone

October 29, 2017 by Joseph Martin

The Windows phone is officially dead, with the announcement from Joe Belfiore that there would be no new feature updates and no further development.

The writing has been on the wall for a while now, with Microsoft gutting its phone division and laying off thousands of employees. But until Belfiore’s announcement, the company hadn’t made it official.

Microsoft was very slow to recognize how big a footprint smartphones would ultimately have on the market, and as such, paid little attention to them when they were first introduced.

Their first serious effort to try and gain a foothold in the market was with the introduction of Windows CE, a “lite” version of Windows that was plagued with problems almost from the start.

The company tried again with Windows 8, which was redesigned with apps specifically in mind.

Unfortunately, it represented too much of a change and was introduced too quickly. The new OS was not well-received.

Windows 10 essentially represented a “do-over”, and to the company’s credit, it was much more well-received than its predecessor. However, by the time the company hit upon something that may have worked, the market was already too mature, and the big players were already too well-entrenched for the company to have a realistic shot at gaining significant ground.

They struggled to get a sufficient number of developers interested in writing apps for their phone, and even if they had, their app store was plagued with problems. Thus, the company’s decision to pull the plug was not terribly surprising.

Mr. Belfiore stressed that the company would continue to support the platform, providing bug fixes and security patches to all those who wish to continue using them, but as the already small user base continues to shrink, it will eventually reach a point where it’s simply no longer financially viable to do even that.

Joseph Martin

Top Subject People Fall Victim To Is – Data Breach Notification

Ransomware Continues To Evolve On Android Devices

Hard Drives Susceptible To Sound Waves, Can Double As Microphones

After Yet Another Equifax Hack, IRS Suspends Contract Worth $7.5M

Popular Chrome Ad Blocker Faked, 30k Users Infected With Malware

New Hack Attempts To Access Office 365 Passwords

OnePlus Mobile Phone Found To Be Collecting User Data

2012 Disqus Hack Exposed More Than 17 Million Users

Microsoft Officially Pulls Plug On Windows Phone

Contact Info

Navigation