security – Page 2

IP Spoofing Attacks Show Significant Increase

October 23, 2018 by Joseph Martin

Gaming and Gambling are huge industries with a truly global footprint. It’s no surprise then, that these industries have become an increasingly popular target for hackers.

Interestingly, according to the latest report issued by ThreatMatrix, the attack vector of choice when it comes to these industries is IP Spoofing. It has increased by a staggering 257 percent since this time last year, making it far and away the fastest growing attack vector in the gambling and gaming industry.

A spokesman for ThreatMatrix had this to say about the report:

“Rising cybercrime levels is no small issue for a sector that enjoys a truly global customer base. With more than two billion gamers worldwide, nearly 60 percent of the industry’s traffic is cross-border.

Operators must contend with a rapidly evolving regulatory landscape and stringent new anti-money laundering laws, making the verification of the true location of a transacting gamer a vital component in authenticating identity.”

Note that at least some of the increase in IP spoofing stems from the gamers themselves, specifically in countries where certain gaming activities may be illegal. Gamers who wish to participate anyway, in violation of their country’s laws, have to fake an IP address to make it appear that they are located in some other country.

Another key finding of the report is the fact that an increasing percentage of gamers and gamblers access sites primarily from their mobile devices. Mobile access has increased by 45 percent between this year and last. As of now, fully 71 percent of gaming and gambling transactions are made on a mobile device, which is serving to make them an increasingly attractive target for hackers.

A TreatMatrix spokesman continues to explain, saying:

“To deal with these challenges, gaming and gambling operators must incorporate dynamic digital identity intelligence that pieces together key indicators such as device intelligence, true geolocation, online identity credentials and threat analysis to better inform risk decisions. The key is to be able to effectively differentiate trusted users from fraudsters and understand changes in trusted user behavior without adding unnecessary friction.”

A daunting challenge indeed.

Joseph Martin

President & CEO
I hope you enjoyed this article. My mission is to take your stress away from dealing with IT problems. Call (252) 565-1235 or send me a message at our contact us page if you have a question, comment or want help.

Another Data Breach, This Time At The Pentagon

October 20, 2018 by Joseph Martin

As many as 30,000 people made up of a mix of both civilian and military personnel have had their personal and financial information exposed. This exposure is what has been reported as a major security breach of the Pentagon.

This is proof positive that no organization is safe from watchful hackers scattered all around the world.

The Associated Press report on the incident includes:

“The department is continuing to gather additional information about the incident, which involves the potential compromise of Personally Identifiable Information (PII) of DoD personnel maintained by a single commercial vendor that provided travel management services to the department. This vendor was performing a small percentage of the overall travel management services of the DoD…The department is continuing to assess the risk of harm and will ensure notifications are made to affected personnel.”

While there’s no good time for a data breach like this, it couldn’t have come at a worse time. The Government Accountability Office (GAO) had issued a scathing report of critical vulnerabilities in virtually all of the weapons systems programs the agency currently runs.

A small excerpt of the report reads as follows:

“One test report indicated that the test team was able to guess an administrator password in nine seconds…Multiple weapon systems used commercial or open source software, but did not change the default password when the software was installed, which allowed test teams to look up the password on the internet and gain administrator privileges for that software.”

It gets worse. When confronted with the findings of the report, Pentagon officials dismissed the report as being unrealistic.

Clearly, there was something to the report, or this breach would not have happened. The hope is that it will be sufficient to cause Pentagon officials to do some soul searching and reevaluate their positions. If not, you can bet that something like this will happen again.

Joseph Martin

Spectre Security Built Into New Intel Chip Hardware

October 17, 2018 by Joseph Martin

By now, almost everyone has heard of the Spectre and Meltdown security flaws that have been making headlines for more than a year. They’re serious flaws with dire implications for tens of millions of users around the world who have an intel-based PC.

The saga surrounding the fixes for these issues has been a long one and filled with twists and turns. Intel originally attempted to push a software fix to protect its chips, but the patch they issued was so flawed that the company requested users not install it and wait for a better, more reliable patch.

In time, that patch was issued, but unfortunately, the protection it offered carried a hefty price in the form of significant system slowdowns.

The longer-term solution was, of course, to re-engineer the chips themselves. Recently, Intel announced that some of their 9th Generation chips will come with built-in fixes to ward against both Spectre and Meltdown. Note the word “some.”

Specifically, the company’s new line of K-series chips, used in gaming CPU’s have been re-engineered to be resistant to those security flaws. Unfortunately, the X-Series (Xeon-class chips) don’t feature those security fixes.

The reason is that they’re based on the older Skylake-X architecture, and given that, the company is relying solely on software updates to protect those chips.

At a recent desktop press event, the company had this to say about the matter:

“…the new desktop processors include protections for the security vulnerabilities commonly referred to as ‘Spectre,’ ‘Meltdown,’ and ‘L1TF.’ These protections include a combination off the hardware design changes we announced earlier this year as well as software and microcode updates.”

Although Intel has been roundly criticized for its handling of the issues surrounding these flaws, this is undeniably a step in the right direction.

Joseph Martin

Major Facebook Breach May Have Affected Your Account

October 16, 2018 by Joseph Martin

Facebook got hit hard by a currently unknown group of hackers. If you recently found yourself inexplicably logged out of the social media site, Facebook did it in response to the breach.

The breach resulted in the theft of data pertaining to more than fifty million of the site’s users.

Here’s what we know so far about the attack:

The hackers pulled off their heist by taking advantage of three different vulnerabilities.

Facebook detected the breach after spotting an unusual spike in traffic.

Your password has not been compromised, but unfortunately, the hackers don’t need it.

The hackers stole more than fifty million access tokens. These tokens can be used to take over Facebook accounts without passwords, even if you have two-factor authentication enabled.

If you were in the compromised group, the hackers have every scrap of personal information you’ve entered into the social media site.

If you use the “Logged in as Facebook” feature on other websites, those accounts are also at risk. The hackers can use the stolen tokens to access any site you log into with your Facebook credentials.

The reason you got logged out was because Facebook reset access tokens for everyone they suspected may have had their data stolen.

To find out if you’ve been hacked, you can check “Active Sessions” on Facebook. If you see an unknown IP address, or a location in some other country, that’s a sure sign that you’ve been hacked.

This breach is not connected in any way to the hacker who pledged to delete Mark Zuckerberg’s personal Facebook page.

In addition to that, you should know that Facebook is now facing a class-action lawsuit over the hack. The suit alleges that the company failed to protect their personal data from falling into the wrong hands due to the company’s lack of proper security practices.

While the vulnerabilities have been fixed, the class-action lawsuit has a good chance of succeeding. The investigation is still in its early stages, and there may be updates to this story as we learn more.

Joseph Martin

Apple IOS12 Users’ Photos And Contacts May Be Vulnerable

October 13, 2018 by Joseph Martin

Jose Rodriguez, a Spanish Apple enthusiast, has discovered a new security flaw to be aware of. He posted a Proof of Concept video showing the exploit in action.

We’ll say upfront that this is a highly convoluted attack involving more than two dozen discrete steps. A hacker would need to be in possession of the phone to pull it off, so it’s not something that’s likely to become a major threat.

Even so, we’ll provide the details below.

Apple has built in security measures that are designed to prevent someone from tricking Siri into allowing unauthorized access to the phone. Unfortunately, by using a complex series of steps involving both Siri and Apple’s Notes application, it’s possible for a hacker to bypass those security measures, access images stored on the phone, and then change the image associated with a contact or the owner of the phone.

This method is effective on both iOS12 and the iOS 12.1 beta, which means that Apple’s recent patch to their OS does not and will not prevent this exploit from working. Worse, the company has yet to comment on the matter, so at this point, there’s no timetable for a fix.

The independent news site Threatpost has been able to replicate the attack, so we have third-party confirmation.

Fortunately, there’s a simple way to negate the attack entirely while we’re waiting for a patch to close the loophole once and for all. Simply go to Settings – Face ID & Passcode – Touch ID & Passcode, and disable the “Allow access when locked” option for Siri.

Again, it’s important to reiterate that this is a highly complex attack that involves having both physical access to the device and more than two dozen steps, so this is not an issue that’s likely to be widespread. Even so, it pays to take precautions until Apple can roll out a fix.

Joseph Martin

Payment Pages Are Being Compromised To Steal Data

October 10, 2018 by Joseph Martin

Symantec’s most recent statistics have revealed a disturbing trend. Malware designed to compromise checkout pages is seeing a big spike in use, with the company reporting a staggering 248,000 attempts since August 13th of this year, with more than a third of them (36 percent) between September 13th through September 20th. As disturbing as those numbers are, that’s just the tip of the iceberg.

As Symantec notes on their website:

“If we compare the week of September 13 to 20 to the same week in August, the number of instances of formjacking attacks blocked by Symantec more than doubled, jumping from just over 41,000 to almost 88.500 – a percentage increase of 117 percent.”

Leading the surge is a particularly nasty strain of malware known as “Magecart.” Magecart campaigns are quite robust that begin by breaching the target website, then injecting malicious scripts into it that are designed to scrape card details and other customer information provided during the checkout process. This is an attack that’s alternately known as formjacking, payment card scraping, and web-based skimming.

Symantec isn’t the only company to take note of the trend. RiskIQ has been sink holing domains associated with Magecart infrastructure for much of the month and alerting companies compromised by Magecart attacks as they find them.

Kevin Beaumont, an independent security researcher, had this to say via Twitter :

“#TrackingMagecart I’ve updated the IoCs to double the number of domains, now tracking over 1000 objects – some of the domains have now been sink holed. Recommend InfoSec vendors block/flag domains.”

Magecart isn’t new. Security researchers have been tracking it since 2015, and independent researcher Willem de Groot has created a malware scanning website called MageReport, which allows business owners to check to see if their Magento-based webshop is vulnerable to this type of attack. If you think you might be, it certainly bears making use of.

At present, the one thing that’s not known is the reason behind the sudden spike. Only that it’s happening.

Joseph Martin

How Long Before You Experience A Cyber Attack?

October 9, 2018 by Joseph Martin

According to this year’s Traveler’s Risk Index, published by The Traveler’s Indemnity Company, a majority of business owners have a somewhat fatalistic view of hacking and data breaches.

The index includes 52 percent of survey respondents indicating that they believe a cyber-attack is inevitable.

The other statistics in the report paint a grim picture. Here’s a quick overview:

55 percent of business owners say that they have not completed a cyber risk assessment

63 percent say that they have not yet completed a cyber risk assessment on vendors who have access to their data

62 percent indicate that they have not yet developed any kind of business continuity plan, which means they don’t even have the basic outline of the steps they’ll need to take in the face of a successful attack against their company

The number of survey participants saying they have been the victim of a cyber attack has doubled from 10 percent in 2015 to 20 percent in this year’s survey

Yet in spite of this staggering lack of preparation, fully half of all survey respondents say they have cyber insurance.

Tim Francis, the Enterprise Cyber-Lead at Travelers, had this to say about the report:

“Cyber risks carry serious consequences for any business, threatening everything from revenue to operations. These findings reveal some surprising things about how companies view their cyber exposure, their relative confidence in dealing with them and the clear opportunity that exists for them to be better prepared for a cyber-attack.”

It’s a thorny problem, for sure. Most small to medium sized business are strapped for cash and simply can’t dedicate the level of resources they’d like to toward data security.

The good news is that this most recent survey reveals a few simple, low-cost things you could do starting today that would dramatically improve your chances of dealing with a cyber-attack. Given that most people agree it’s inevitable and just a matter of time, that would be an excellent place to start.

Joseph Martin

Firefox Adds Data Breach Monitoring Service

October 6, 2018 by Joseph Martin

Firefox is upping the ante where digital security is concerned, having just announced the release of a new, free service called ‘Firefox Monitor.’ The new service is designed with one specific goal in mind: To assist users in finding out if their accounts were exposed via a data breach.

It was developed in partnership with Troy Hunt, whose website, “Have I Been Pwned” is one of the most popular destinations on the web for security-minded individuals. This website, in fact, is the driving force behind Mozilla’s new service.

People will be able to engage with the service in two different ways. First, by making a direct inquiry to check the status of their various accounts, passwords, and email addresses that may have been compromised. Or second, by configuring the new subsystem to notify them when their information has been detected by the system.

Nick Nguyen, of Mozilla, had this to say about the new feature:

“It can be hard to keep track of when your information has been stolen, so we’re going to help by launching Firefox Monitor, a free service that notifies people when they’ve been part of a data breach. After testing this summer, the results and positive attention gave us the confidence we needed to know this was a feature we wanted to give to all of our users.”

If you find out via active polling or receive a notification that one of your accounts was compromised, you should take action immediately. You should change the password and audit the account to address instances where you may have used the same password associated with the compromised account in order to minimize your risks.

This is great news, and a fantastic addition by Mozilla. While it’s not a magic bullet that will solve all your security woes, it should help give users greater peace of mind, and it puts a powerful new tool in their hands to monitor the integrity of their own accounts. Kudos to Mozilla!

Joseph Martin

Government Payment Processor Exposes Data On Millions Of Americans

October 4, 2018 by Joseph Martin

If you use the GovPayNet portal, be advised that your personal information is currently at risk. Although at this point, there’s no indication that any hacker has made use of it. The portal is run by Government Payment Service, and is used by many Americans to pay fines, fees and bills generated by more than two thousand different government agencies operating in 35 states.

Unfortunately, the way the website is configured, when it issues a receipt for a payment, it numbers those receipts sequentially. All a hacker would have to do would be to change the receipt number in the URL to see any previous receipts, and all of the information it contains.

When the flaw was discovered by journalist Brian Krebs, more than fourteen million old records were exposed in this manner. He contacted Government Payment Service to inform them of the flaw, and the agency moved quickly to address the issue. They said in a formal statement that they “did not adequately restrict access to only authorized recipients.”

They went on to assure their users that there’s no indication that any data had been improperly accessed. They added that the receipts generated don’t include any information that could be used by a hacker to initiate any type of financial transaction.

Unfortunately, the reality was a bit different. The receipts contain the names, addresses and phone numbers of the person paying the fee in question, along with the last four digits of whatever credit or debit card was used to make payment. That is more than enough information to enable a hacker to initiate a phishing attack to get the rest.

Nick Bilorgoskiy of Juniper Networks had this to say about the matter:

“Online payment providers…should take special care to protect their customers’ receipts by using HTTPS and checking that the user is logged in and has permissions to view them. To avoid information disclosure and directory traversal issues, I also recommend denying anonymous web visitors the ability to read permissions for any unnecessary files from web-accessible directories.”

It’s good advice, and here’s hoping that Government Payment Service will take it. If you use the service, there’s nothing for you to do. You don’t need to change your password, since it was never exposed. Just be mindful that someone may have seen any data your receipts contain before the site was secured.

Joseph Martin

Google’s Emergency Location Service Improves 911 Response

October 3, 2018 by Joseph Martin

Google is making a small but pivotal change as it relates to calls placed to 911 operators. Having recently finalized a complex partnership with RapidSOS and West (two emergency technology companies) and T-Mobile, Google will now send location data from its “Emergency Location Service” when an Android user places a 911 call.

If the caller is a T-Mobile customer, the information will be passed along via the carrier. Where 911 call centers use RapidSOS, Google will send the location data via the technology company. In the US Virgin Islands, Google has made the same arrangement with the Emergency Tech company, West.

While the announcement may raise some surprised eyebrows, the change has been in the works for more than a year. Google has spent much of that time testing. Their findings were that the location data Google sent over was more accurate and arrived more quickly than the data the 911 call centers had been getting previously.

Not to be outdone, Apple announced in June of this year that it was developing a similar service for iOS users, and that beginning with iOS 12, Apple devices would automatically send location data to emergency call centers when users dial 911.

Even privacy advocates agree that this is generally a good move, and it’s one of the growing number of instances where smart use of technology can save lives. Anything we can do to give our nation’s emergency call centers an edge is an important change. Currently, those call centers take an average of 140,000 calls a day, so this is by no means a trivial issue.

Kudos to both Google and Apple for taking bold action on this issue. While we may not like the idea of having our location data shared, in this particular instance, it certainly seems like a smart play.

Joseph Martin

IP Spoofing Attacks Show Significant Increase

Another Data Breach, This Time At The Pentagon

Spectre Security Built Into New Intel Chip Hardware

Apple IOS12 Users’ Photos And Contacts May Be Vulnerable

Payment Pages Are Being Compromised To Steal Data

How Long Before You Experience A Cyber Attack?

Firefox Adds Data Breach Monitoring Service

Government Payment Processor Exposes Data On Millions Of Americans

Google’s Emergency Location Service Improves 911 Response

Contact Info

Navigation