Daily Archives: May 5, 2020

Getting Zoom Security Right – 8 Tips for Family and Friends

If you’ve read a newspaper or watched the news in the past few weeks, you’ll notice one common topic that all the major news outlets are discussing… COVID-19. Right now, many companies are trying to provide employee guidance during this worldwide pandemic, as governments ask those who can to work from home in an effort […]… Read More

The post Getting Zoom Security Right – 8 Tips for Family and Friends appeared first on The State of Security.

Maze Ransomware Targets the Hospitals and Labs Fighting Coronavirus

“Never let a good crisis go to waste.” These wise words have been recently attributed to former Bill Clinton Chief of Staff Rahm Emanuel, though Freakonomics actually dates it back to 1976 and a completely different context. Regardless of who first uttered the phrase or some permutation of it, modern-day cybercriminals have taken the candid […]… Read More

The post Maze Ransomware Targets the Hospitals and Labs Fighting Coronavirus appeared first on The State of Security.

Download: ‘Coronavirus Cyber Security for Management’ Template for CISOs

The Coronavirus crisis introduces critical operational challenges to business continuity, placing high stress on organizations' management. As a result, CIOs and CISOs face a double challenge on the cyber risk front – apart from the new risks that the mass transfer of employees working remotely brings, capturing the management mindshare for further investments in security becomes harder than

Warning: Citrix ShareFile Flaw Could Let Attackers Steal Corporate Secrets

Since the past few weeks, software giant Citrix has privately been rolling out a critical software update to its enterprise customers that patches multiple security vulnerabilities affecting Citrix ShareFile content collaboration platform. The security advisory—about which The Hacker News learned from Dimitri van de Giessen, an ethical hacker and system engineer—is scheduled to be available

Why Do I Need a Password Manager?

Whether you’re on the internet all day or sign on only occasionally, all of us have a lot of passwords to manage. What’s more, security experts recommend we use powerful and unique passwords for each online account to prevent serious crimes like identity theft. Fortunately, there’s an easy solve – a password manager.

How can you choose a safe password?

Today, hackers use sophisticated software that can decipher all but the most secure passwords. Your pet’s name or your child’s birthday, while personal, isn’t necessarily a stumbling block for hacking software these days. Randomly generated passwords using a long and unique string of characters are simply the only answer, and password managers use that technique.

Can you safely store passwords on your computer or mobile phone?

If you keep your passwords on your computer’s hard drive, they become an easy target for hackers or scammers who gain remote access to your computer. In fact, any time you share your computer all your private information becomes available, including that master list of passwords. Likewise, when you store the passwords to your accounts on your phone, they become accessible to anyone who gains access to that device, like thieves. Using a password manager allows you to store your passwords on secure servers, away from prying eyes, hackers, and thieves.

What does a password manager do?

Let’s face it, many of us have bad password habits. That’s where a password manager can help. This piece of software creates secure passwords, stores them, and automatically inputs them when you access your various online accounts.

That’s right, a password manager can create the long, complicated combinations of characters that make a truly secure password. And the best part is that it remembers them for you. The days of using the same password for every single account are over. With this piece of software, you only need to remember one password, the one for the password manager.

How does a password manager help you?

A simple password offers almost no protection, and studies show that many people choose their birthday or numbers in sequential order. Hackers bank on that behavior to allow them to gain access to your accounts with their sophisticated software. A password manager can thwart attempts to break into your bank account, email and social media sites that can catch you unaware otherwise. The combinations of capital and lowercase letters, symbols, numbers and punctuation marks that a password manager generates make it exponentially harder for hackers to steal your stuff.

Can you safely rely on a password manager?

You may be asking what if a hacker breaks into my password manager? It’s an unlikely scenario, but even if it were to happen, a password manager encrypts your data and makes it unreadable. There are also a few best practices you can follow to make your manager even more effective and reliable. First, while using a password manager ensures you only need to remember one password, you need to make sure that password is a strong one. That means you need to make it a random mix of capitals, lowercase letters, numbers and symbols. Also, make sure you turn off the autofill feature on your browser and copy and paste your passwords from your manager in manually.

Using a Password Manager Simplifies Password Security

A password manager is a convenient and highly effective product that addresses all the of issues we’ve discussed in this article. It provides a single location where you can manage and store all your online passwords securely. Choose a password manager that lets you instantly create secure and complex passwords to protect your online presence from trespassers. It should also provides a security-restricted site for your passwords and let you access them from any internet-connected device. By using a password manager, you maintain a more secure presence on the web, you protect your bank account, email and social media activities from intrusion by hackers. Best of all, you gain the peace of mind that comes from knowing your most valuable assets are being protected.

The post Why Do I Need a Password Manager? appeared first on McAfee Blogs.

Ghost Blogging Platform Hacked To Mine Cryptocurrency

Hackers successfully breached the servers of a popular blogging platform and used them to mine cryptocurrency.

Ghost, a Singapore-based blogging platform with 2,000,000 installations and 750,000 active users, announced that hackers had breached their systems. 

“The mining attempt… quickly overloaded most of our systems which alerted us to the issue immediately,” the company announced May 3, adding that “[t]here is no direct evidence that private customer data, passwords or other information has been compromised. 

The hackers compromised Ghost’s servers by exploiting two major vulnerabilities in SaltStack, a network automation tool typically used by IT support and system administrators. Ghost is just one of several companies and organizations that have been compromised since the vulnerabilities were disclosed, including LineageOS, an Android-based operating system, and Digicert, a security certificate authority. 

As of May 4, Ghost announced that it had successfully purged the cryptocurrency mining malware from its systems. The company also stated that they would be notifying their customers, which include NASA, Mozilla, and DuckDuckGo.

 

The post Ghost Blogging Platform Hacked To Mine Cryptocurrency appeared first on Adam Levin.

Change This Browser Setting to Stop Xiaomi from Spying On Your Incognito Activities

If you own a Xiaomi smartphone or have installed the Mi browser app on any of your other brand Android device, you should enable a newly introduced privacy setting immediately to prevent the company from spying on your online activities. The smartphone maker has begun rolling out an update to its Mi Browser/Mi Browser Pro (v12.1.4) and Mint Browser (v3.4.3) after concerns were raised over its

Security executives succeeding in the chaotic coronavirus world

I recently interviewed several CSOs and CISOs from the financial services, tech, healthcare, media and other industries to see how they were managing through these turbulent times. Below are the questions I asked them and a summary of their collective wisdom and best practices. While I would love to give these experts all the credit they deserve, all of them spoke on the condition that neither they nor their organizations be identified publicly.

What is your greatest security concern right now?

The collective response to this question is that security executives are most worried about the increase in phishing campaigns and fraud, especially with distracted employees who aren’t as diligent with security hygiene while working from home. As one executive stated, “My greatest concern right now is social engineering resulting from cyberattacks on people wherever they are. High stress means reduced cognitive functions, so attackers may find it easier to do social engineering, which opens the door to everything else.” 

To read this article in full, please click here

Poor Password Practices: The Curse of the Cybersecurity Risk Index Score

Reading Time: ~ 3 min.

Your password passing habit may not be as be as harmless as you think. And yes, that includes Netflix login info too.

That’s one finding to come out of our newly released study of 2020’s Most (and Least) Cyber-Secure States. In this year’s analysis of the cyber readiness of all 50 U.S. states, and in partnership with Wakefield Research, we created a “Cyber Risk Hygiene Index” based on 10 metrics meant to measure individual and state-level cyber resilience against adverse online events.

If you’re unfamiliar with the report, you can read an introduction here.

Unfortunately for many Americans, two of those cyber hygiene metrics involved questions about their password habits:

  • Do you avoid sharing passwords with others?
  • Do you avoid reusing passwords?

Now, these questions weren’t the only reason no American received a passing grade on our Cyber Risk Hygiene Index, or that no state scored higher than a D, but they didn’t help. In all, the report found that more than one-third (34%) of Americans admit to sharing passwords and login credentials with others. Nearly half (49%) report having more accounts than passwords, meaning passwords are being reused across accounts.

Perhaps even more troubling is the finding that sharing passwords for streaming services—that famously widespread and supposedly benign new-age habit—has a worrying correlation: Americans who share passwords for streaming services (38%) are twice as likely to say they have had their identity stolen than those who do not (18%).

This is alarming because sharing and reusing passwords is especially dangerous during this golden age of phishing attacks. It means that, as soon as a cybercriminal achieves success in one phishing attack, those pinched credentials are likely to work for several other popular sites. A single successful phishing expedition could yield catches on banking sites, credit card applications, online marketplaces, and in a host of other potentially lucrative instances.

Even by sharing passwords with those a smidge less than trustworthy—or just careless—you’re increasing your attack surface area. Now that network of individuals who now have access to your accounts are susceptible to giving your information away if they take the bait in a phishing attack.

“Instead of giving away the keys to the guest room when you share passwords, it’s more like giving away keys to the castle if they are reused across multiple accounts,” says Webroot threat analyst Tyler Moffitt, “you could begiving away the keys to the whole kingdom if that’s the only password you use.”

More password facts from the report

  • Tech Experts, one of the riskiest categories of users studied in our report, are more likely to share passwords (66%) than the average American (44%). Clearly, we at Webroot are in no position to point fingers.
  • On brand, 66 percent of so-called “Mile Markers” refrained from sharing passwords, compared to 63 percent for the average American. This group scored the highest on our index and is defined by having progressed through life markers such as earning a degree, owning a home, or having children.
  • Home-based Very Small Businesses (VSBs) are less likely to work with a dedicated IT team. As a result, they are more likely to use their personal devices for work and share passwords. Of these, 71 percent use the same passwords for home and business accounts, potentially cross contaminating their work and personal lives with the same security gaps.
  • By generation, Gen Z is most likely to share passwords (56%), followed by Millennials (47%), Gen X (33%), and Boomers (19%).

How to address poor password practices

In terms of a personal password policy, it’s important to set yourself up for success. Yes, it’s true the amount of passwords one is responsible for can be dizzying, 191 per business according to one popular study.

That, and the parameters for creating a sound password seemingly grow more complex by the day. It used to be enough just to have a password. But now, they must be x characters long, contain one number and one special characters and so-on… And did we mention we recommend it be a passphrase, not a traditional password?

You get the gist.

That’s why our single strongest piece of advice to users looking to upgrade their cyber resilience is to use a password manager. This allows you to create long, alphanumeric and otherwise meaningless passwords without the need to keep tabs on them all.

After you’ve created a strong bank of passwords, managed through a password management service, supplement your security by adding two-factor authentication (2FA). Measures like 2FA pair your login credentials—something you know—with something you have, like a biometric feature or a mobile phone. This will ensure lifting your password (a unique one for each account, no doubt) isn’t even enough to crack your account.

“Put simply, an account simply isn’t as secure as it could be without 2FA,” says Moffitt. “And that means your credit card info, home address, or bank accounts aren’t as safe as they could be.”

No more reusing passwords. And, hopefully, no more sharing passwords. But that part’s up to you. You just have to ask yourself, is Netflix access worth having your identity stolen?

The post Poor Password Practices: The Curse of the Cybersecurity Risk Index Score appeared first on Webroot Blog.

Digital Fraudsters Masquerading as FINRA in Phishing Emails

The Financial Industry Regulatory Authority (FINRA) warned that digital fraudsters are impersonating it in an ongoing phishing email campaign. In a regulatory notice published on its website, FINRA revealed that malicious actors had sent out fraudulent emails in which they had impersonated officers at the regulatory authority including Bill Wollman and Josh Drobnyk. All of […]… Read More

The post Digital Fraudsters Masquerading as FINRA in Phishing Emails appeared first on The State of Security.

Malware in Google Apps

Interesting story of malware hidden in Google Apps. This particular campaign is tied to the government of Vietnam.

At a remote virtual version of its annual Security Analyst Summit, researchers from the Russian security firm Kaspersky today plan to present research about a hacking campaign they call PhantomLance, in which spies hid malware in the Play Store to target users in Vietnam, Bangladesh, Indonesia, and India. Unlike most of the shady apps found in Play Store malware, Kaspersky's researchers say, PhantomLance's hackers apparently smuggled in data-stealing apps with the aim of infecting only some hundreds of users; the spy campaign likely sent links to the malicious apps to those targets via phishing emails. "In this case, the attackers used Google Play as a trusted source," says Kaspersky researcher Alexey Firsh. "You can deliver a link to this app, and the victim will trust it because it's Google Play."

[...]

The first hints of PhantomLance's campaign focusing on Google Play came to light in July of last year. That's when Russian security firm Dr. Web found a sample of spyware in Google's app store that impersonated a downloader of graphic design software but in fact had the capability to steal contacts, call logs, and text messages from Android phones. Kaspersky's researchers found a similar spyware app, impersonating a browser cache-cleaning tool called Browser Turbo, still active in Google Play in November of that year. (Google removed both malicious apps from Google Play after they were reported.) While the espionage capabilities of those apps was fairly basic, Firsh says that they both could have expanded. "What's important is the ability to download new malicious payloads," he says. "It could extend its features significantly."

Kaspersky went on to find tens of other, similar spyware apps dating back to 2015 that Google had already removed from its Play Store, but which were still visible in archived mirrors of the app repository. Those apps appeared to have a Vietnamese focus, offering tools for finding nearby churches in Vietnam and Vietnamese-language news. In every case, Firsh says, the hackers had created a new account and even Github repositories for spoofed developers to make the apps appear legitimate and hide their tracks.