Cybersecurity Tips for Online Holiday Shopping
The holiday shopping season is prime time for digital purchases and cybercriminals are cashing in on the merriment. With online shopping officially becoming more popular than traditional in-store visits this year, all signs point to an increase in cyberattacks. It’s more important than ever to be mindful of potential dangers so you can avoid getting Scrooged when buying online. Follow these top tips for secure online shopping.
Only use credit cards. If your debit card gets compromised, it has the
potential to cascade in catastrophic ways; automatic bill payments may bounce
or overdraft protections may drain secondary accounts. Some banks also have
strict rules about when you need to notify them of suspected fraud, or else you
could be liable for the costs.
On the other hand, the Fair Credit
Billing Act provides some protections for consumers from
unauthorized charges on credit cards. Additionally, it’s much easier to have
your credit card replaced with new, uncompromised numbers and details than it
is with bank account info.
Be
cautious of deal and discount emails. During the holidays, there’s always a spike in
physical and electronic mailers about special deals. At this point, we’re all
used to that. We might even wait to buy something we want, knowing that it’ll
probably go on sale during holiday clearance. Unfortunately, criminals use this
expectation against us by sending cleverly crafted phishing emails to trick us
into compromising our data.
Always be cautious about emails from unknown senders or even trusted
third-party vendors, especially around the holidays. Always navigate to the
deal website separately from the email — don’t just click the link. If the deal
link can only be accessed through the email, it’s best to pass up on those
supposed savings. It is also prime time for emails offering “free
giftcards” avoid those like the plague.
Never make purchases without HTTPS. Check the URL—if it doesn’t start with HTTPS,
it doesn’t have SSL encryption. SSL (secure sockets layer) encryption is a
security standard for sharing information between web servers and a browser.
Without it, your private information, including your credit card number, can be
more easily intercepted by cybercriminals.
Keep in mind: HTTPS only ensures that the data you send will be encrypted on
the way, not that the destination is legit. Cybercriminals have started to use
HTTPS to trick website users into a false sense of security. That means, while
you should never send private or financial data through a site that doesn’t
have HTTPS, you shouldn’t rely on the presence of HTTPS alone to guarantee the security of the page.
Don’t make purchases on devices you don’t personally own. If you’re using a borrowed or shared device, such as a computer at a library or a friend’s phone, don’t make any purchases. Even if it’s a seemingly safe device that belongs to a person you know and trust, you have no way of knowing how secure it really is. It’s pretty unlikely that you’ll encounter a lightning deal that’s worth the hassle of financial fraud or identity theft. So just wait on that purchase until you can make it on your own device.
Never use unsecured public WiFi for online purchases. Many public WiFi networks, like the ones at your local café, the gym, a hotel, etc., are completely unsecured and unencrypted. That means anyone with the know-how can easily track all of your online activities while you’re using that network, including any login or banking information. Even worse, hackers are capable of dropping viral payloads onto your device through public networks, which can then spread to your other devices at home.
Always use a VPN when you’re on public WiFi, if you have to use it at all. Otherwise, we suggest using a private mobile hotspot from your phone instead. (See our section on VPNs below.)
Use a password manager to create strong passwords. You can often stop a security breach from spreading out past the initial impact point just by using a trusted password manager, such as LastPass, which will help you create strong passwords. A password manager will create and store them for you, conveniently and securely, so you don’t have to remember them or write them down somewhere. Taking this step will help protect you from potential third-party breaches as well, like the one Amazon announced just before Black Friday in 2018.
Encrypt your traffic with a virtual private network (VPN). A VPN allows you browse privately and securely by shielding your data and location in a tunnel of encryption. So even if you are unwittingly using a compromised network, such as the unsecured public WiFi at your favorite morning coffee stop, your VPN will prevent your private data from being scooped up by cybercriminals. But be sure you’re using a trusted VPN—many free options secretly collect and sell your data to turn a profit.
Install antivirus software and keep it up to date. A VPN will protect your data from being tracked and stolen, but it can’t protect you if you click on a malicious link or download a virus. Make sure your antivirus software is from a reliable provider and that it’s not only installed, but up to date. Most antivirus products today will even update themselves automatically (as long as you don’t turn that feature off), so make sure you have such settings enabled. It may make all the difference when it comes to preventing a security breach.
Keep a close eye your bank and credit accounts for suspicious activity. The fact of the matter is that the holiday season causes a peak in malicious online activity. Be proactive and check all of your financial records regularly for suspicious charges. The faster you can alert your bank or credit provider to these transactions, the faster you can get a replacement card and be back on your merry way.
Don’t fall victim to cybercrime this holiday season. Be mindful of all the links you click and online purchases you make, and be sure to protect your devices (and your data and identity) with a VPN and strong antivirus software!
Cyber News Rundown: Zeppelin Ransomware
Zeppelin Ransomware Spreading
Over the last month, researchers have been monitoring the spread of a new ransomware variant, Zeppelin. This is the latest version of the ransomware-as-a-service that started life as VegaLocker/Buran and has differentiated itself by focusing on healthcare and IT organizations in both the U.S. and Europe. This variant is unique in that extensions are not appended, but rather a file marker called Zeppelin can be found when viewing encrypted files in a hex editor.
German ISP Faces Major GDPR Fine
The German internet service provider (ISP) 1&1 was recently fined for failing to protect the identity of customers who were reaching out to their call centers for support. While the incident took place in 2018, GDPR is clear about imposing fines for organizations that haven’t met security standards, even if retroactive changes were made. 1&1 is attempting to appeal the fines and has begun implementing a new authentication process for confirming customers’ identities over the phone.
Turkish Credit Card Dump
Nearly half a million payment cards belonging to Turkish residents were found in a data dump on a known illicit card selling site. The cards in question are both credit and debit cards and were issued by a variety of banking institutions across Turkey. This likely means that a mediating payment handler was the source of the leak, rather than a specific bank. Even more worrisome, the card dump contained full details on the cardholders, including expiration dates, CVVs, and names; everything a hacker would need to make fraudulent purchases or commit identify theft.
Pensacola Ransomware Attack
The city of Pensacola, Florida was a recent victim of a ransomware attack that stole, then encrypted their entire network before demanding $1 million ransom. In an unusual message, the authors of the Maze ransomware used explicitly stated that they had no connection to the recent shootings at the Pensacola Naval Base, nor were they targeting emergency services with their cyberattack.
Birth Certificate Data Leak
An unnamed organization that provides birth certificate services to U.S. citizens was contacted earlier this week in regard to a data leak of nearly 750,000 birth certificate applications. Within the applications was sensitive information for both the child applicant and their family members, which is highly sought after by scammers because it is relatively easy to open credit accounts for children with no prior credit history. Researchers are still waiting to hear back from the organization after finding this data dump in an unsecured Amazon Web Services bin.
Cyber News Rundown: ZeroCleare Malware
ZeroCleare Malware Wiping Systems
IBM researchers have been tracking the steady rise in ZeroCleare deployments throughout the last year, culminating in a significant rise in 2019. This malware is deployed on both 32 and 64-bit systems in highly targeted attacks, with the capability to completely wipe the system by exploiting the EldoS RawDisk driver (which was also used in prior targeted attacks). The malware itself appears to be spreading through TeamViewer sessions and, though the 32-bit variant seems to crash before wiping can begin, the 64-bit variant has the potential to cause devastating damage to the multi-national corporations being targeted.
FTC Scam Threatens Victims with Terrorism Charges
FTC officials recently made an announcement regarding scam letters purporting to be from the commission and the numerous complaints the letters have sparked from the public. Victims of the scam are told that, due to some suspicious activity, they will be personally and financially monitored as well as face possible charges for terrorism. These types of scams are fairly common and have been in use for many years, often targeting the elderly with greater success.
Take back your privacy. Learn more about the benefits of a VPN.
Misreported Data Breach Costs Hospital Millions
Following an April 2017 complaint, the Office of Civil Rights has issued a fine of $2.175 million after discovering that Sentara Hospitals had distributed the private health information for 577 patients, but only reported eight affected. Moreover, it took over a year for the healthcare provider to take full responsibility for the breach and begin correcting their security policies for handling sensitive information. HIPAA violations are extremely time-sensitive and the slow response from Sentara staff could act as a lesson for other organizations to ensure similar events don’t reoccur.
Android Vulnerability Allows Hackers Easy Access
Researchers have identified a new Android exploit that allows hackers access to banking applications by quickly stealing login credentials after showing the victim a legitimate app icon, requesting additional permissions, and then sending the user to their expected app. Even more worrisome, this vulnerability exists within all current versions of AndroidOS and, while not found on the Google Play Store, some illicit downloaders were distributing it.
Smith & Wesson Hit by Magecart
In the days leading up to Black Friday, one of the largest retail shopping days of the year, malicious skimming code was placed onto the computer systems and, subsequently, the website of Smith & Wesson. In a slight break from the normal Magecart tactics, they attackers were masquerading as a security vendor to make their campaign less visible. The card-skimming code was initially placed onto the website on November 27 and was still active through December 2.
What You Need to Know about Cyberbullying
Have you noticed a decrease in your child’s happiness or an increase in their anxiety? Cyberbullying might be the cause to these behavioral changes.
Bullying is no longer confined to school playgrounds and neighborhood alleys. It has long moved into the online world, thanks to the easy access to technology. Between Twitter, SnapChat, TikTok, Instagram, WhatsApp, or even standard SMS texts, emails and instant messages, cyberbullies have an overwhelming number of technical avenues to exploit.
While cyberbullying can happen to anyone, studies have shown that teens are usually more susceptible to it. The percentage of individuals – middle and high school students from across the U.S. — who have experienced cyberbullying at some point, has more than doubled (19% to 37%) from 2007 to 2019, according to data from the Cyberbullying Research Center.
Before you teach your kids how to respond to cyberbullying, it is important to know what it entails.
Check out our Cybersecurity Education Resources
What is Cyberbullying?
Cyberbullying is bullying that takes place over digital devices like cell phones, tablets, or computers. Even smaller devices like smartwatches and iPods can facilitate cyberbullying. Today, social media platforms act like a breeding ground for cyberbullying.
Cyberbullying usually begins with teasing that turns to harassment. From there it can evolve in many ways, such as impersonation and catfishing, doxxing, or even blackmail through the use of compromising photos.
Catfishing is the process of creating a fake identity online and using it to lure people into a relationship. Teens often engage in impersonation online to humiliate their targets and it is a form of cyberbullying.
Doxxing is used as a method of attack that includes searching, collecting and publishing personal or identifying information about someone on the internet.
Identifying the Warning Signs
When it comes to cyberbullying, just like traditional bullying, there are warning signs for parents to watch for in their child. Although the warning signs may vary, Nemours Children’s Health System has identified the most common ones as:
- being upset or emotional during or after internet or phone time
- being overly protective of their digital life and mobile devices
- withdrawal from family members, friends, and activities
- missing or avoiding school
- a dip in school performance
- changes in mood, behavior, sleep, or appetite
- suddenly avoiding the computer or cellphone
- being nervous or jumpy when getting an instant message, text, or email
- avoiding conversations about their cell phone activities
Remember, there are free software and apps available to help you restrict content, block domains, or even monitor your child’s online activity.
While having a child who is being cyberbullied is every parent’s nightmare, it’s equally important to understand if your child is cyberbullying others.
Do you believe your child is a cyberbully? That difficult and delicate situation needs its own blog post—but don’t worry, we have you covered.
You’ll also find many cyberbullying prevention and resolution resources on both federal and local levels, as well as support from parents going through similar issues on our community forum.
Preparing your kids for a world where cyberbullying is a reality isn’t easy, but it is necessary. By creating a safe space for your child to talk to you about cyberbullying, you’re setting the foundation to squash this problem quickly if it arises.
Simplified Two-factor Authentication for Webroot
Webroot has evolved its secure login offering from a secondary security code to a full two-factor authentication (2FA) solution for both business and home users.
Webroot’s 2FA has expanded in two areas. We have:
- Implemented a time-based, one-time password (TOTP) solution that generates a passcode which is active for only a short period of time.
- Given our users the option to either opt-in or opt-out, especially those that leverage Webroot for home and personal use.
Starting in December, with the new updates, users will find it easier to use industry-vetted options, including Google Authenticator, Microsoft Authenticator, LastPass Authenticator, and Authy 2-Factor Authentication.
Why Two-Factor Authentication?
First and foremost, we encourage all users to opt-in to maintain a higher level of security. Two-factor authentication adds an extra layer of security to your basic login procedure. When logging into an account, the password is a single factor of authentication, and requiring a second factor to prove you are who you say you are adds a layer of security. Each layer of security you add exponentially increases protection from unauthorized access and makes it harder for brute force and credential stuffing attacks to occur.
A Note to Businesses
Users will have the option to opt-in or opt-out of the new Webroot 2FA feature. The Admins tab within our console will show you which of your users have or have not enabled 2FA.
To learn how to enable two-factor authentication, visit the Webroot Community.
Cyber News Rundown: Shade Ransomware Most Distributed Variant
Shade Ransomware Takes Crown as Most Distributed Variant
Over the course of 2019, one ransomware variant, known as Shade, has taken over 50 percent of market share for ransomware delivered via email. Otherwise known as Troldesh, this variant receives regular updates to further improve it’s encrypting and methods of generating additional revenue from both cryptomining and improving traffic to sites that run ads. In just the first half of 2019, attacks using Troldesh dramatically rose from 1,100 to well over 6,000 by the second calendar quarter.
PayMyTab Leaves Customer Data Exposed
For more than a year sensitive customer data belonging to users of the mobile payment app PayMyTab has been publicly exposed in an online database using no security protocols. Even after being contacted multiple times regarding the data breach, the company has yet to fully secure customer data and may have to take drastic measures to fully secure their data storage after allowing virtually unlimited access to anyone with an interest in personal data.
Credentials Dump for Major Service Sites
Login credentials for two highly-trafficked websites were discovered in a data dump earlier this week. One dump belonged to GateHub, a cryptocurrency wallet with potentially up to 1.4 million user credentials stolen, including not only usernames and passwords, but also wallet hashes and keys used for two-factor authentication. The second dump contained information on 800,000 users of EpicBot, a RuneScape bot used to automate tasks in the skill-centric MMORPG. While both dumps appeared on dark web marketplaces on the same day, it also seems coincidental that both sites use bcrypt hashing for passwords, which should make them exceedingly difficult to crack assuming it was set up properly.
Louisiana Government Systems Hit with Ransomware
Multiple Louisiana state service sites were taken offline early Monday morning following a ransomware attack that affected mostly transportation services. All 79 of the state’s DMV locations were forced to close until systems were returned to normal, as they were unable to access DOT services to assist clients. While it is still unclear what variant of ransomware was used, the state of Louisiana did have a cybersecurity team in place to stop any further spread of the infection.
Magecart Targets Macy’s Online
Nearly a week after the initial breach, Macy’s officials noticed some unauthorized access between their main website and an undisclosed third-party site. The breach itself appears to have compromised payment card data for any customers who input their credentials during the first couple weeks of October. Macy’s has since removed the illicitly added code from their sites as well as contacted both payment card providers and affected customers regarding the breach.
5 Tips for Feeling Your Best in Your Home Office
With major advancements in communication technology, many of us are fortunate to be able to work from home. Working from home can be a huge productivity boost—saving you gas and time by not commuting, plus you get to work more on your own terms. If you’re able to work from home here are five tips to make sure you stay productive and feeling good in your home office.
Get Comfortable
Not so comfortable that you fall asleep, but we all know how miserable an uncomfortable office chair can be. By working at home, you have the opportunity to completely build your own environment. That means finding the right furniture for you.
If you’re looking for a high-quality office chair, an underrated place to look is gaming chairs, which were built for long hours of sitting. However, a high-quality chair from your local furniture store would likely also do the trick.
Or, maybe instead of sitting all day, you prefer to stand. Luckily, there is an abundance of standing desks available for your choosing, many of which are easily adjustable so you can alternate between sitting and standing.
In addition to ergonomics, you also want to think about how to decorate your home office. For example, having plants in your office can actually help reduce stress and improve productivity. If you can, try to choose a room that has lots of natural lighting, which can help you stay healthy, concentrated, and even sleep better at night.
However you want to set up your home office, it’s important that you do what’s most comfortable for you.
Limit Distractions…But Not Too Much
If you’re going to be working from home, you may have to deal with more distractions than you would in the office, especially if you have pets or family moving around the house. Because of this, it’s important you try to limit distractions, not letting your eyes wander to the television or Facebook. After all, you may be the only one keeping yourself accountable.
If you have people in the home who could be distracting, make sure you choose an office space that has a door, possibly in a more remote part of the home, rather than working in common spaces. It’s a good idea to also ask your friends and family members to respect your work hours.
At the same time, you will need breaks from time to time, so don’t be afraid to keep distractions at hand, but out of sight. If you know that you struggle with concentration without someone looking over your shoulder, there are a number of apps you could try that help promote focus and productivity.
Secure Your Devices
Now that you are in charge of your own office, you may also be in charge of making sure that it is secure. Namely, you want to make sure you have proper cybersecurity measures in place. This will help you keep peace of mind while you’re working, but also ensure you’re not derailed by cybercriminals or unexpected computer failures.
First and foremost, you want to make sure your devices and data are protected with a consumer antivirus (AV) or endpoint protection. If your company consists only of you or you are working remotely from your personal computer, a consumer AV may be right for you. However, if your company has a few employees and you need to manage multiple endpoints, a business endpoint solution is a better option.
Regardless of which solution is right for you, it’s important to remember that all security products are not created equal. The top antivirus and endpoint protection products are cloud-based, have a small digital footprint—meaning they won’t slow down your computer—are actively protecting against known and never-before-seen threats, and are able to reverse any damage that occurs if your device is compromised.
Another measure you should consider is backing up your data. While this can be done using a physical external hard drive, they can also be compromised when plugged in. The best option is using a cloud-based backup and recovery service.
Ransomware attacks alone increased over 350 percent in 2017 and have since become more sophisticated, targeting larger victims including government organizations. Given that, protecting your devices and your data is no longer a luxury. It’s a necessity.
Declutter Often
We all know how cluttered a desk can get. Depending on your job, you may have papers strewn about, multiple desktops, or a pile of sticky notes in shorthand you can no longer quite decipher. But a cluttered environment can lead to a cluttered mind.
In fact, Lynne Gilberg, a professional organizer in Los Angeles, CA told WebMD, “Clutter is bad for your physical and mental health…A lot of people express that they are overwhelmed. They become nonfunctional and nonproductive.” It’s important to keep your area organized and tidy to be more productive and creative in the long run.
Plus, remember that this is still your home, and you may not want your family or guests to consider your office an eyesore. If you’re ever overwhelmed by chaos in your home office, here are some tips for helping clean up your work area.
Separate Personal and Professional
When working from home, it’s easy to blur the lines between your personal and professional lives. However, it is important that you resist this tendency to blend the two. Thinking too much about work at the dinner table can disconnect you from family and friends. And managing day-to-day family tasks while on the clock can hurt productivity.
You may want to establish strict working hours to help keep your two home lives separate. Let’s say from 8-5 you concentrate on work and then, after five p.m., you concentrate on your family, friends, and anything else that may need to get done around the home.
Looking to build a more complete, detailed schedule? The New York Times highlighted some tips for building a work-from-home schedule that will help you stay on task and stay productive.
Some Final Tips for Your Home Office
- Consider getting exercise equipment for short breaks. Things like resistance bands, small weights, or even a treadmill can help keep your blood flowing on a long work day.
- Stock up on supplies. You’ll still need pens, paper, and other work supplies in your home office. Make sure you are always stocked.
- Dress for work. Just because you have the option to work in your underwear, doesn’t mean you should.
To learn more about how criminals are targeting the healthcare industry, as well as what needs to be done about it, check out the second installment of this blog: Healthcare Cyber Threats That Should Keep You up at Night.
Cyber News Rundown: Orvis Password Leak
Orvis Internal Credentials Leaked
A database containing login credentials for numerous internal systems belonging to Orvis, one of America’s oldest retailers, was found to be publicly available for an unknown amount of time. Why the database was publicly accessible at all is still unclear, but the retailer has determined that many credentials were for decommissioned devices. They managed to resolve the security dilemma for the remaining devices relatively quickly.
Mexican Oil Company Hit by Ransomware Attack
A few days ago, Pemex Oil was targeted by a ransomware attack that, according to reports, affected 5% of their computer systems. The demanded ransom, as displayed by the note left by the DoppelPaymer ransomware variant, was 565 bitcoins, or roughly $4.9 million. Fortunately, Pemex had a decent security strategy in place and was able to get their operations running normally by the following day.
Facebook Bug Turns on iPhone Cameras
The latest bug from Facebook is one that turns on the user’s iPhone camera when they open the Facebook app. It appears the bug only works on phones running iOS version 13.2.2, and for users who accepted permissions to allow the app to access the camera. Unfortunately for Facebook, many of its users are already wary of the company’s privacy policies, and so-called “bugs” like this one only serve to increase the level of distrust within its customer base.
PureLocker Ported to All Major Operating Systems
A new ransomware variant, PureLocker, has been successfully ported from Windows® operating systems to both MacOS® and Linux® systems with the typical capacity to fully encrypt all discovered files. Researchers have found that it encrypts files on compromised systems using .CR1 as the file extension, a tag which also appears in the text-based ransom note. This may be tied to a particular affiliate, as PureLocker is being distributed as Ransomware-as-a-Service.
Cyberattack on UK Labour Party
Officials for the UK Labour Party have issued a statement regarding a cyberattack on their computer systems, though it appears that the security they had in place was enough to repel the attack. While they are still unsure as to the origin of the attack, they were able to determine that it was a DDoS attack (Distributed Denial of Service), which floods the targeted systems with an overwhelming amount of cyber-traffic.
Shoring Up Your Network and Security Policies: Least Privilege Models
Why do so many businesses allow unfettered access to their networks? You’d be shocked by how often it happens. The truth is: your employees don’t need unrestricted access to all parts of our business. This is why the Principle of Least Privilege (POLP) is one of the most important, if overlooked, aspects of a data security plan.
Appropriate privilege
When we say “least privilege”, what we actually mean is “appropriate privilege”, or need-to-know. Basically, this kind of approach assigns zero access by default, and then allows entry as needed. (This is pretty much the opposite of what many of us are taught about network access.) But by embracing this principle, you ensure that network access remains strictly controlled, even as people join the company, move into new roles, leave, etc. Obviously, you want employees to be able to do their jobs; but, by limiting initial access, you can minimize the risk of an internal breach.
If you haven’t already, now is the perfect time to take a look at your network access policies. After all, it’s about protecting your business and customers—not to mention your reputation.
Navigating the difficult conversations around access control
It’s no surprise that employees enjoy taking liberties at the workplace. In fact, Microsoft reports that 67% of users utilize their own devices at work. Consequently, they may push back on POLP policies because it means giving up some freedom, like installing personal software on work computers, using their BYOD in an unauthorized fashion, or having unlimited usage of non-essential applications.
Ultimately, you need to prepare for hard conversations. For example, you’ll have to explain that the goal of Principle of Least Privilege is to provide a more secure workplace for everyone. It’s not a reflection on who your employees are or even their seniority; it’s about security. So, it’s essential for you, the MSP or IT leader, to initiate the dialogue around access control––often and early. And, at the end of the day, it’s your responsibility to implement POLP policies that protect your network.
Firewalls and antivirus aren’t enough
There’s a common misconception in cybersecurity that the firewall and/or antivirus is all you need to stop all network threats. But they don’t protect against internal threats, such as phishing or data theft. This is where access policies are necessary to fill in the gaps.
Here’s a prime example: let’s say you have an employee whose job is data entry and they only need access to a few specific databases. If malware infects that employee’s computer or they click a phishing link, the attack is limited to those database entries. However, if that employee has root access privileges, the infection can quickly spread across all your systems.
Cyberattacks like phishing, ransomware, and botnets are all designed to circumvent firewalls. By following an appropriate privilege model, you can limit the number of people who can bypass your firewall and exploit security gaps in your network.
Tips to achieve least privilege
When it comes to implementing POLP in your business, here are some tips for getting started:
- Conduct a privilege audit. Check all existing accounts, processes, and programs to ensure that they have only enough permissions to do the job.
- Remove open access and start all accounts with low access. Only add specific higher-level access as needed.
- Create separate admin accounts that limit access.
- Superuser accounts should be used for administration or specialized IT employees who need unlimited system access.
- Standard user accounts, sometimes called least privilege user accounts (LUA) or non-privileged accounts, should have a limited set of privileges and should be assigned to everyone else.
- Implement expiring privileges and one-time-use credentials.
- Create a guest network leveraging a VPN for employees and guests.
- Develop and enforce access policies for BYOD or provide your own network-protected devices whenever possible.
- Regularly review updated employee access controls, permissions, and privileges.
- Upgrade your firewalls and ensure they are configured correctly.
- Add other forms of network monitoring, like automated detection and response.
Cyber News Rundown: Nikkei BEC Scam
BEC Scam Takes Millions from Nikkei America
Officials for Nikkei are working to identify the perpetrators of a recent business email compromise (BEC) scam that took roughly $29 million from the company’s American subsidiary. The illicit transfer took place sometime during the end of September and, though they did make a public statement last week, the only clues they have are the Hong Kong bank account that the funds were sent to. While this is not the largest scam of this type to occur this year, it does serve to underscore the prevalence and continued success of these attacks.
Canadian Province Shuts Down After Ransomware Attack
Government networks for the Nunavut territory of Canada have been taken offline following a ransomware attack that appears to have been executed by an unwitting employee. Fortunately, even thought their security systems failed to block the infection, the affected offices keep regular backups to safeguard against this type of issue. However, even with these failsafe measures, it may still take about a week to get all of the official systems back to full operation.
Facebook API Allows Unauthorized Access to User Accounts
Several developer apps have been found retaining user info and photos from Groups for much longer than previously anticipated by Facebook. This is, by no means, the first time in recent years that Facebook has fallen under scrutiny; it comes nearly a year after the Cambridge Analytica findings, not to mention the more recent news about the company removing thousands of apps that had been misusing customer data. While the social media giant has made a number of changes to stop these types of data leaks, they clearly still have a lot more work to do to ensure their clients’ data is safe.
Indian Education Firm Data Leak
A database belonging to an Indian tech firm may have exposed sensitive information for over 600,000 customers. Even more alarming than the high number of victims is that this leak seems to have begun back in July of this year, begging the question as to why it took so long for the firm to make an official announcement. Due to the sheer volume of exposed data, the company has already started contacting affected customers in hopes of preventing any further misuse of their information.
MegaCortex Ransomware Demos New Tactics
The latest variant of MegaCortex has brought with it a plethora of new features and functionality. While it does still perform RSA encryption on nearly every file on the machine, it now also has the ability to change the main system password, making it very difficult for the victim to access their own system at all. In addition to the typical ransom note that demands quick crypto-based payment, this variant also threatens victims in lurid detail as to how their encrypted files will be published to the masses.
Cyber News Rundown: Bed, Bath, & Beyond Data Breach
Bed, Bath, & Beyond Data Breach
An official announcement made earlier this week acknowledged illicit access to customer data used in online accounts for Bed, Bath, & Beyond. While the breach didn’t affect payment card information, the retailer quickly began contacting affected customers and took steps to safeguard against future incidents.
Johannesburg Shutdown After Cyber Attack
Three months after a cyber attack hit Johannesburg, South Africa, the city is once again dealing with network outages. After a ransom note was posted to several social media outlets, city officials are still attempting to downplay the attacks by claiming they purposefully took down the sites rather than them being ransomed by hackers. In addition to the ransom note, hackers also posted screenshots proving their control over the city’s network systems and their expectation of payment.
UniCredit Financial Data Leak
Officials working for UniCredit, an Italian banking firm, announced that unauthorized access to their systems has left the sensitive information of nearly 3 million Italian exposed. Fortunately, the stolen information did not include any financial data, but did contain personally identifiable information such as names and contact details. It is unclear how hackers gained access to the data, though it appears the data may have even been taken years earlier in prior security breaches faced by the firm.
Ransomware Shuts Down New Mexico School District
Las Cruces Public Schools, a New Mexico school district, was forced to take their entire system offline following a ransomware attack. While email and other important services are still offline, students have still been attending classes as normal, though the process of fully remediating the incident has just begun. It is still unclear how the attack was initiated, but it’s the latest in a long line of educational institutions that have fallen victim to ransomware this year.
Malware Attack on Indian Power Plant
It has been confirmed that both an Indian nuclear power plant and another piece of infrastructure have fallen victim to a malware attack apparently tied to North Korean actors. Fortunately, the attacks did not allow unauthorized control of the systems, though this attack may have been only a test to determine security and response times in preparation for a larger, future attack.
The Truth about Phishing & the Psychology of Why We Click
“Phishing” may have been a relatively obscure term, but pretty much everyone has heard of it by now. In fact, recent statistics indicate a high likelihood that you—or someone you know—have been the victim of a phishing attack at least once.
Now, if you remember the classic Nigerian Prince scams from back in the day, you might be asking yourself how the stats could be so high. After all, it seems pretty unlikely that an otherwise cautious person would fall for something like that, right? And in today’s cyber-climate, where the news is filled with headlines about major hacks and malware infections that spread like wildfire, why would anyone click on links from unknown senders or hand over their sensitive, personal information (think SSNs, etc.) without verifying the authenticity of the request? It turns out, there are a lot of subconscious influences at play, and the thing that makes phishing attacks so successful is the way they take advantage of our trust, curiosity, fear, greed, and even desire to do a good job at work.
Understanding the factors that drive a successful phishing attack is fundamental to preventing them in the future. That’s why Webroot partnered with Dr. Cleotilde Gonzalez, research professor at Carnegie Mellon University, to take a deep dive into the psychology of phishing.
Tip #1: Maintain strong, unique passwords. Using individual passwords for each of your accounts will help prevent fraud, identity theft, and other malicious activity. Consider using a secure password manager, and enable two-factor authentication wherever possible.
What kind of person clicks a phishing link, anyway?
The truth? We all do it. While 86% of Americans believe they can distinguish a phishing message from a genuine one, 62% have had their personal information compromised as part of a breach. So what’s the deal here?
“People are generally overconfident about their ability to spot the fakes. Overconfidence is a big problem in many human actions. In this case, this probably happens because the ratio of phishing emails to regular emails feels low, so our mind underestimates the probability of receiving a phishing email, and in turn, overestimates our ability to identify one if we do.” – Cleotilde Gonzalez, Ph. D.
Tip #2: Stay on your toes. The more overconfident and complacent you are about your security, the easier it is for you to be phished. Don’t play into a cybercriminal’s hands. Maintaining a healthy level of suspicion about all links and attachments in messages may make all the difference during an attempted breach.
How are phishers using psychology against us?
By tapping into our own personal sense of urgency, cybercriminals are able to manipulate us in subtle ways that we may not realize until it is too late. Hackers often use cleverly disguised email handles and targeted messaging, known as “spear phishing,” to create a sense of trust and familiarity. This makes links appear more legitimate, and makes us perceive the click as less risky.
“Ultimately, urgency, familiarity, and context have a strong impact on decision making. If you already expect to receive emails from your boss at your office (context and familiarity), and you are accustomed to messages that request quick action (urgency), then you are likely to assume the message is real. It might never occur to you to suspect that it could be phishing.” – Cleotilde Gonzalez, Ph. D.
What are the most convincing ways for a phisher to tap into your sense of urgency to get you to open their email?
- 65% of Americans prioritize emails from their boss
- 54% prioritize emails from family or friends
- 33% prioritize emails to confirm bank transactions
That means you shouldn’t feel weird or guilty for verifying odd requests from bosses, family, or friends. If your boss sends you an email asking for out-of-the-ordinary action, don’t hesitate to call them up and ask them for details. (Do this instead of replying to the email.) Same with links, downloads, and requests for information from family and friends. It never hurts to double-check.
Practicing phishing mindfulness, even when clicking links from seemingly trustworthy sources, cuts down significantly of the efficacy of spear phishing attacks. Pay close attention to sender addresses and handles, as well as signatures. If you get an email from your bank, financial institution, or even a regular website for which you have a login, navigate to their official website independently instead of clicking through on that potentially risky email.
Tip #3: Back everything up and do it regularly. All of your important data and files should be regularly backed up to a secure hard drive or cloud storage. When using a physical hard drive, only connect it while backing up. This will help prevent the drive from being affected by an infection.
Why are we still clicking?
Here’s the thing: 76% of Americans know they have received a phishing email, and yet still 56% of people would feel comfortable clicking on a link or attachment from an unknown source on their personal devices. So why are so many of us still willing to jeopardize our safety for an unknown link?
“Risk and under-weighed probability are linked. Risks sometimes come with rewards, right? So if the risk seems low and the reward seems high, you’ll make riskier decisions. It’s like gambling; our minds explore different gain/loss experiences, then respond with risk-taking or risk-averse actions.” – Cleotilde Gonzalez, Ph. D.
Tip #4: Always keep your software up-to-date. Hackers are known to regularly exploit security holes in outdated software and operating systems. By installing software updates when prompted, you can stop many cybercriminals in their tracks.
What if you’ve been phished? Now what?
With 62% of those surveyed reporting some type of data breach, it’s important to know what to do in the event of a breach that can help keep the damage to a minimum. George Anderson, Product Marketing Director at Webroot, recommends the following steps:
- Change your account passwords immediately! That includes accounts you don’t believe were breached, but are using the same or a similar password.
- Set up alerts with your credit agency.
- Void existing credit cards and order new ones.
- Engage a credit security service.
- Notify law enforcement or the appropriate government agency.
While some of these steps may seem obvious to you, they clearly need to be repeated; of people whose information was stolen or exposed, a baffling 32% didn’t bother to change their account passwords afterward.
Dr. Gonzales shared her thoughts on what can be done to combat this type of complacency.
“These findings illuminate the fact that what we really need here is a mindset makeover,” she says. “The longer-term reward of security needs to be highlighted, front and center, not placed on the backburner. To do that, we’re going to have to shift the way that people think about security and prioritize their responsibilities. We have to allow the time and brain space for security-related considerations.”
What can we all do going forward?
You can nurture the type of security mindset shift Dr. Gonzalez references by taking small steps. First, you know those software and security updates you (like many people) are probably putting off? Just do them. Enable two-factor authentication wherever possible, especially on important online accounts like your banking and credit institution websites.
You may even find that your heightened security practices influence those around you to make stronger choices. After all, seeing a person you know being on top of their game can be very motivating to start making personal changes!
Remember, the most important thing you can do is avoid overconfidence. Don’t underestimate the risk of a phishing attack. Doing that is exactly what will make you a prime target for criminals.
“It’s a classic case of underweighting probabilities, but explicit numbers speak for themselves. Providing this information might help people calibrate the risk and confidence more accurately.” – Cleotilde Gonzalez, Ph. D.