Blog – Page 9

E-Mail Is A Big Threat To Your Organization

August 4, 2018 by Joseph Martin

Mimecast’s 2018 “State of Email Security” report is out, and although it’s contents are hardly a surprise, the news it contains is mostly bad.

For starters, it confirms what most IT professionals already know:

Email continues to be a big threat for organizations of all sizes.

Unfortunately, the C-Suite (CEO’s, CIO’s, CFO’s, and the like) are a major part of the problem, representing a significant weak link in Enterprise security. Not only are they a prime target for hackers, but according to the survey, 40 percent of respondents agreed that their organization’s CEO was a painfully “weak link” in their organization’s cyber-security operations.

Just as alarming, 31 percent of respondents said that C-level employees are very likely to have accidentally sent sensitive or proprietary information to the wrong person, a statistic up 9 percent from last year.

In addition to that, email is the primary means by which ransomware winds up getting inside company networks. This comes with a staggering 92 percent of successful ransomware attacks arriving via that channel, resulting in three or more days of downtime for the impacted companies.

Phishing attacks also continue to be a major issue, with 90 percent of respondents reporting an increase in the number of phishing attacks they were subjected to.

In light of these statistics, one would imagine that companies would be devoting significant resources to countering the threat. Unfortunately, that’s just not happening. Sure, money is being spent on infrastructure, but humans are the weakest link in this chain, and not just in the C-Suite. According to the survey, only 11 percent of organizations continuously train their employees on how to spot cyberattacks, and just over half (52 percent) perform training just once a year.

Matthew Gardiner, a cyber-resilience expert at Mimecast, summarizes it this way :

“Security awareness is an important part of any high-functioning security program. But like all security controls, there is no silver bullet solution. The best security programs seek a balance between technical controls, boosting their human firewalls, and having IT enabled business processes that are resilient to failures, whether man-made or caused by technology.”

Indeed.

Joseph Martin

President & CEO
I hope you enjoyed this article. My mission is to take your stress away from dealing with IT problems. Call (252) 565-1235 or send me a message at our contact us page if you have a question, comment or want help.

Chrome Now Shows Sites Without SSL as Not Secure

August 2, 2018 by Joseph Martin

There is a small but significant change from Google, with the release of Chrome 68. The updated browser will now prominently notify browsers when they surf their way to non-HTTPS websites, displaying them as “Not Secure.”

This is Google’s latest step in a long campaign to try and make the web a safer and more secure place for internet users around the world.

If you’re not especially tech-savvy, here’s why it matters:

Anything sent over a non-HTTPS connection is in plain text, including sensitive information like credit card payment info and passwords. This makes it a trivial matter for hackers to snoop and/or steal data. The new “Not Secure” message that Chrome displays is a clear indication to browsers that there’s no SSL Certificate to encrypt the connection between your website’s server and the user’s computer.

Non-HTTPS connections have been considered dangerous for a number of years, but as hackers have gained increasing levels of sophistication, the dangers have only grown over time.

Google has intentionally taken a slow, measured approach to making this change in order to give business owners plenty of time to respond. They began the process in January 2017, with the release of Chrome 56, by displaying a subtle “Not Secure” warning in the address bar of any non-secure websites that were collecting passwords and credit card information on their customers.

Then, in October 2017, the company upped the ante with the release of Chrome 62, which saw the browser begin to display the “Not Secure” warning for any HTTP website that had any kind of text input field. This culminated in the release of Chrome 68, which prominently displays the message for all non-secure sites, period.

The bottom line is, the change has been a long time coming, and if your company hasn’t yet enabled HTTPS on your website, the time to do so is now.

Joseph Martin

Bluetooth Vulnerability Allows Hackers To Access Devices

August 1, 2018 by Joseph Martin

There’s a new Bluetooth security vulnerability to be aware of, tracked as CVE-2018-5383, and it’s a nasty one.

It’s a cryptographic vulnerability that affects firmware or operating system software drivers from a number of major vendors, including Qualcomm, Broadcom, Intel and Apple. At this point, the implication of the bug on Linux, Android, and Google are unknown.

The flaw is related to two important Bluetooth features: BR/EDR implementations of Secure Simple Pairing in device firmware and Bluetooth Low Energy (BLE) of Secure Connections Pairing in OS system software.

It was discovered by researchers operating out of Israel’s Institute of Technology. They discovered that the Bluetooth specification recommends (but critically does not mandate) that devices supporting the two features make any effort to validate the public encryption key received during secure pairing.

Since the specification is optional, it’s hardly a surprise that some vendors producing Bluetooth products do not take sufficient steps to validate the parameters used to generate public keys during the exchange.

This allows a would-be hacker the possibility of executing a man-in-the-middle attack to obtain the cryptographic key used by the device. This would give them the opportunity to not only spy on the device’s owner, but also to inject malware that could allow the hacker to take full control over the device.

SIG (the Bluetooth Special Interest Group which maintains the technology), had this to say about the flaw:

“For an attack to be successful, an attacking device would need to be within wireless range of two vulnerable Bluetooth devices that were going through a pairing procedure.

The attacking device would need to intercept the public key exchange by blocking each transmission, sending an acknowledgement to the sending device, and then injecting the malicious packet to the receiving device within a narrow time window. If only one device had the vulnerability, the attack would not be successful.”

Bluetooth SIG has now updated the specification to require products to validate public keys received as part of the public key-based security procedures. Of the manufacturers mentioned above, Apple and Intel have both released patches. Broadcom has made fixes available to its OEM customers who are responsible for providing them to end-users. There has been no word yet from Qualcomm.

Joseph Martin

Girl Scouts Can Now Earn New Badges For High Technical Skills

July 31, 2018 by Joseph Martin

The girl scouts have officially moved into the 21st century.

The Girl Scouts of America recently announced the creation of a whole raft of new badges that address (in the organization’s words) “some of society’s most pressing needs.”

A total of 30 new badges will be available exclusively for girls between the ages of five to eighteen for efforts and advocacy in the following areas:

Computer Science

Cybersecurity

Environment

Robotics

Space Exploration

Badges are awarded on the basis of completing specific tasks. So, for instance, when a girl learns how to code and completes a small project, she could be awarded with the new computer science badge, and when she builds a simple robot, the robotics badge would be awarded.

This is part of an ongoing effort to boost interest and participation in fields where women are generally under-represented.

According to the Girl Scouts USA CEO, Sylvia Acevedo:

“Whether they are fighting cybercrime, exploring how engineers solve problems, or advocating for issues affecting their community, Girl Scouts are learning how to proactively address some of the foremost challenges of today, while also building skills that will set them up for a lifetime of leadership.”

In recent years, the Girl Scouts have struggled to maintain enough membership nationally to remain viable. This is at least one of the reasons why the Boy Scouts of America announced in October 2017 that they would begin accepting girls into their program.

It remains to be seen whether the move to modernize the badges available to girls in the organization will be enough to boost membership and ensure the organization’s long-term viability. Even if it’s not, it’s a fantastic idea and long overdue. Kudos to Girl Scouts’ leadership for taking innovative action, and to all the girls who earn these new badges!

Joseph Martin

Hackers May Set Their Sights On Your GPS Next

July 30, 2018 by Joseph Martin

If you’re like most people, you probably rely heavily on the GPS function of your phone. Type in an address and your phone helpfully guides you, turn by turn, to your destination. It’s one of the most often utilized features of a smartphone, and of course, the hackers are very interested in interfering with it.

Until now though, hackers have been unable to fool humans into driving to the wrong destination by hacking their GPS, because their instructions often make no sense given the prevailing terrain features the humans are seeing on the road. For instance, nobody is going to turn left into a Jiffy Lube parking lot or a corn field just because GPS says to (unless your destination was Jiffy Lube, of course).

That’s changing, thanks to researchers from Virginia Tech and the University of Electronic Science and Technology of China.

The team has devised a way to hack into a GPS system and spoof the results well enough to fool humans, giving bogus driving directions that seem to make sense given local conditions, and as such, don’t raise red flags.

Accomplishing the task was no small feat, involving the creation of an algorithm that works in something close to real time. This along with a portable device for spoofing GPS that can be attached to the car of your target or placed in a trailing car. Its effective range is about fifty meters.

Once the equipment is in place, the algorithm crafts GPS inputs that follow the real world road network, allaying suspicion in 95 percent of the team’s test cases, while still ultimately sending the target to the wrong destination.

There are any number of ways this exotic type of attack could be used, but the two primary use cases would be to intentionally steer the target into hazardous road conditions, or to lure them to an isolated area where a physical attack could be carried out.

Unfortunately, in the months and years ahead, we can probably count on seeing both.

Joseph Martin

New Report Shows 32 Percent Increase In Cyber Attacks

July 28, 2018 by Joseph Martin

Positive Technologies has just released a new report that paints a grim picture for IT professionals. If your sense is that the number of cyberattacks are increasing, you’re not wrong. In fact, it’s probably worse than you realize.

So far this year, we’ve seen a staggering 32 percent increase in the total number of cyberattacks in the first quarter of 2018, compared to the same period last year. Even worse, malware attacks have increased by a mind-bending 75 percent since the first quarter of 2017.

Individuals were far and away the most frequent target (28 percent), but government agencies came in a reasonably close second (16 percent), with business in the healthcare, finance, and IT sectors rounding out the top five (8 percent, 7 percent, and 5 percent, respectively).

Of the malware deployed against targets this year, spyware was by far the most common, with stealth cryptocurrency mining software not far behind.

Leigh-Anne Galloway, the cyber security resilience lead at Positive Technologies explains in more detail:

“Our research shows that 63 percent of attacks included use of malware. Spyware, in particular, is used most often because it allows obtaining not only personal information and corporate secrets, but credentials for the services and systems needed to attack internal corporate infrastructure.”

Long story short, the prevalence of spyware seen in this report is likely to have cast-off effects in the future. Hackers will gain a sufficient level of access and information, courtesy of their successful spyware attacks, to launch even more harmful attacks against both individuals and government/corporate institutions in the future.

Positive Technologies warns that the number of attacks is likely to continue to escalate, and that there’s no clear end in sight.

The report is dark news if you’re in the digital security business. If your business hasn’t been hit yet, it seems that it’s just a matter of time.

Joseph Martin

Survey Shows Businesses Feel Prepared For A Data Breach

July 27, 2018 by Joseph Martin

A majority of business owners from around the world (68 percent) feel that they’re better prepared to ward off a cyberattack and prevent a data breach than their competitors. This is a figure which is up 8 percent over last year’s statistic for the same question. This, according to a recent survey by FICO.

In the US, power and industrial companies were the most confident, with 86 percent of companies from these sectors rating their firms as either above average, or top-tier in terms of their preparedness. The US financial firms were the least confident, with only 60 percent rating their firms as either above average or top-tier.

Telecommunications companies fell somewhere in the middle, with 72 percent of respondents ranking themselves above average or top-tier.

It may be premature to break out the champagne.

Maxine Holt, a research director on the team conducting the survey says:

“IT leaders have greater funding than ever to protect organizations from the continuously evolving threat landscape and meet complex compliance demands.

These same IT leaders are undoubtedly keen to believe that the money being spent provides their organization with a better security posture than any other – but the rapid pace of investment, often in point solutions, rarely takes an organization-wide view of security.”

In short, the increase in confidence might be illusory. The risk is that if too much is read into these numbers, it may lead to overconfidence, which could lead to an under-investment in security in subsequent years. This can ultimately set these companies (or at least some of them) up for failure and disappointment when their expensive security measures prove not to be nearly as effective as they initially believed.

Even if you didn’t participate in the recent survey, it bears asking the question: How would you rate your company’s ability to fend off an attack, relative to your competition?

Joseph Martin

World Cup Avoided Nearly 25 Million Cyber Attacks This Year

July 26, 2018 by Joseph Martin

According to the Kremlin, Russia prevented almost twenty five million cyber-attacks during the World Cup this year.

President Vladimir Putin praised the nation’s digital security forces by saying the following:

“I expect that your close and constructive interaction will continue and will contribute to ensuring the security of our states and our citizens in the future.”

Given the high-profile nature of the event, it was hardly a surprise that it would be a tempting target. In a survey by Lastline, in the weeks leading up to the World Cup, a staggering 72 percent of security professionals believed that an attack was likely.

The Russians took the threat seriously. In addition to beefing up their own security personnel, they also opened a “Cooperation Center” which was staffed by law enforcement officers from 34 different countries.

Some security professionals have cast doubt on the Kremlin’s figures, while others have at least unwillingly admitted that the figures weren’t out of the question.

David Grout (the Southern Europe Technical Director of FireEye) had this to say:

“Vladimir Putin’s statement that government security services have thwarted 25 million cyber-attacks linked to the FIFA World Cup may seem like a surprisingly high number, but not necessarily for those who work in the field. Every major event, whether sporting, political or otherwise, is likely to attract cyber-attacks. The 2018 World Cup is no exception. Before the competition had even started, there was evidence of Phishing attacks.

This included phishing attacks that started several weeks before the tournament and carried on throughout. These campaigns use several levers such as low-cost ticket offers, the chance to win a trip to Russia, promotions for items related to the World Cup (national team jerseys, mugs featuring players etc.). The main goal in this type of attack is to recover your banking information and force you to go through with the transaction to get the card number information, expiration date and also CCV.”

Even if the numbers are somewhat inflated, kudos to Russia for their deft handling of the event!

Joseph Martin

Clinic Employee Learns That Traveling Increases Data Theft Risk

July 25, 2018 by Joseph Martin

On May 14th, the Billings Clinic in Montana issued a breach notification statement, which explained that they detected unusual activity within one of its employee’s email accounts.

The employee in question was traveling overseas on a medical mission when the email account was compromised.

“As a result of the forensics investigation, we learned that an unauthorized individual had access to emails and attachments within that one account, some of which included patient information.”

As for scope and scale, information on more than 8,400 individuals was exposed. While the data varied from one patient to the next, the data included patient names, dates of birth, contact information, medical record numbers, internal financial control numbers, diagnoses, and some information about medical services received.

The incident highlights a common, but often overlooked problem.

As analyst Rebecca Herold explains:

“It is very common for data and devices to be hacked while traveling and for those who were hacked to not even realize it. People are often unaware of what is going on around them when they are travelling. They are using any charger station they can find, they speak loudly, and they use free Wi-Fi.

Shoulder surfing is also still very common; it’s a decades-old tactic that still works effectively today. The skimmers on charging stations are increasing in use. Don’t think that if you are in a frequent flyer lounge that these things do not happen there; they happen in those exclusive lounge areas possibly more than in other places.”

The bottom line is, any time your employees are away from your office, the risks of hacking increase. While there are no simple solutions, it bears making your employees aware of the added risks any time they’re travelling. It’s far from a perfect solution, but it’s a good place to start.

Joseph Martin

Thermal Imaging Could Help Thieves Steal Your Passwords

July 24, 2018 by Joseph Martin

As if there weren’t enough ways for hackers to steal your passwords, now, there’s thermal imaging. If that sounds like something straight out of a science fiction movie, think again.

Researchers from the University of California at Irvine recently discovered and demonstrated a technique that involves the use of a thermal imaging camera to capture heat traces left by human fingertips as they type passwords into a keyboard. In fact, their technique is effective for up to thirty seconds after the user removes his hands from the keyboard.

Per the researchers, “Although thermal residue dissipates over time, there is always a certain time window during which thermal energy readings can be harvested from input devices to recover recently entered, and potentially sensitive information.”

The team tested their technique using off the shelf technologies, and on four different keyboards. Their findings indicated that a full password could be obtained by scanning for thermal residues on those keyboards, provided that the scan was taken within thirty seconds of the first key being pressed. After a full minute, it was still possible to obtain partial passwords.

They used an FLIR camera on a tripod set two feet from the keyboards being tested, and the results of their findings were published in a paper called simply, “Thermanator.”

FLIR makes a number of different camera models that can capture heat. Their most basic model, the FLIR One Pro is a $400 accessory available as a smartphone attachment. Some phones (like the CAT S61) ship with the FLIR module embedded in the technology.

The team noted that the ease with which a password could be detected in this manner had a lot to do with the typing style of the target being monitored. Passwords entered by “hunt and peck” typists could be gleaned between 19.5 and 31 seconds, while passwords entered by touch typists took upwards of 50 seconds to be gleaned.

Obviously, this is a fairly exotic form of attack. Although it utilizes off the shelf technology, it would require an extraordinary level of access to set the equipment up, and an extraordinary lack of vigilance on the part of security personnel not to detect the equipment in relatively short order. Even so, it’s certainly within the realm of possibility, and one more thing to be on guard against.

Joseph Martin

« Previous Page
1
…
7
8
9
10
11
…
31
Next Page »

E-Mail Is A Big Threat To Your Organization

Chrome Now Shows Sites Without SSL as Not Secure

Bluetooth Vulnerability Allows Hackers To Access Devices

Girl Scouts Can Now Earn New Badges For High Technical Skills

Hackers May Set Their Sights On Your GPS Next

New Report Shows 32 Percent Increase In Cyber Attacks

Survey Shows Businesses Feel Prepared For A Data Breach

World Cup Avoided Nearly 25 Million Cyber Attacks This Year

Clinic Employee Learns That Traveling Increases Data Theft Risk

Thermal Imaging Could Help Thieves Steal Your Passwords

Contact Info

Navigation