Adventure Awaits
(So Do Cybercriminals)
Warm weather and a break from school sparks the spirit of exploration in many families. They hit the road, take to the skies and hop aboard trains, ships and all manner of transportation. The idea is to take a break from the mundane, to navigate new surroundings and to see what kinds of adventure awaits.
That break can have a downside, however. Outside their comfort zones, people often ignore warning signs and red flags, attributing them to the fact they are in a new environment where everything feels slightly unusual. Criminals (
o
f both the
digital and physical realm) count on this. High-travel time is high-crime time in their worlds.
Stay vigilant as you travel. Prepare before you embark by scanning the environment to learn about the latest trips, traps and scams striking across the world. Reading through this month's Tips message is a great place to start.
Feel free to write back with any specific questions and certainly share this with others. The more people we can reach with this information, the better!
|
|
Data Security & Privacy Beacons
|
People and places making a difference**
"Jim Browning"
is the alias for a sort of digital Robin Hood. While his methods are questionable, Jim Browning is fighting the good fight... and beating cybercriminals at their own game. After reporting a series of robocalls from scammers and getting no response from authorities, Jim Browning took action on his own. Using his knowledge of computers, and remote access in particular, he played the victim, allowing the crooks remote access to his computer. He then turned the tables by accessing the scammer's computers and using malware to spy on their operations. Of course I don't recommend people go out and start putting malicious code on devices they don't own. The lesson here is for authorities, especially those in high-cybercrime areas: When something gets reported, investigate and keep people apprised of your findings. Internet vigilantes are fed up and obviously willing to take action!
The FTC is
encouraging the general public to keep their software updated. The agency just released an important alert reminding consumers of technology (which is essentially everyone in the developed world... and many in developing countries) to install new version updates immediately as they become available. This is so important, especially as cyber crooks deploy technology that scans the connected world for technology that is NOT updated. As soon as they find that open door, they walk right through, helping themselves to all of your important files, data, photos and other potentially damaging information.
Verizon, AT&T and T-Mobile are voluntarily following
new rules established by the FCC. The rules make it legal for these companies to offer robocall-blocking technology to their customers by default. Before the new rules, the consumers had access to the technology but had to opt-in. Now, the companies can take action on behalf of their customers, using the data and intelligence they have on a particular call or number. Kudos to these companies for going over and above, implementing even
more actions than those allowed by new rules.
Google
has developed a new security tool that uses an updated cryptography method with tools called Privacy Join and Compute to protect user data. While the method is somewhat old-school (original versions date back to the 1970s), it is highly effective. This seems to indicate Google is at least as interested in privacy as they are in the latest and greatest tech -- an increasing rarity in Silicon Valley. The tool is open source, meaning any developer interested in integrating Private Join and Compute with his/her/its app can do so easily and inexpensively. We'll be keeping a close eye on this tool to evaluate its success.
**P
rivacy beacon shout-outs do not necessarily indicate an organization or person is addressing every privacy protection perfectly throughout their organization (no one is). It simply highlights a noteworthy example that is, in most cases, worth emulating.
|
|
More Than a Dozen Mobile Carriers Hacked for Years in Secret
|
|
Hackers had access to call and text records, geolocation data and more.
Researchers recently announced that more than a dozen mobile carriers in Europe,
Asia, Africa and the Middle East have been hacked since 2012. Per CNET, the hackers not only siphoned off hundreds of gigabytes of personal data from the customers of these networks, they also gained the kind of access that could cause major disruption to the mobile infrastructure of these companies.
"They have all the usernames and passwords, and created a bunch of domain privileges for themselves, with more than one user," security researcher Amit Serper told CNET. "They can do whatever they want. Since they have such access, they could shut down the network tomorrow if they wanted to."
This news is another reminder of a few best practices where passwords are concerned:
1) Change your passwords frequently.
2) Never use the same username and password combination in more than one place.
3) Enable two-factor authentication (2FA) whenever possible.
Why are the above steps so critical?
Good password hygiene drastically reduces the risks when hacker get your ID and password. Hackers feed that stolen date into machine learning and AI tools that scour the internet. Using a method known as credentials stuffing, they attempt to log in to email, social media and even bank accounts. The technology allows them to attempt hundreds of thousands of logins per second, so it's really only a matter of time before they find a winner.
|
|
 |
BlueKeep threat on track to be as bad as WannaCry... if we don't act now.
An advisory by the NSA says approximately a
million internet-facing machines are still vulnerable to BlueKeep, which targets a vulnerability in Microsoft's Remote Desktop Services.
Anyone running Windows Server 2008, Windows Server 2003, Windows 7, Windows XP or Windows Vista is at risk of becoming a victim of the malware. Updating these systems ASAP should be a high priority.
If for some reason upgrading your device to a supported version of Windows is not possible, experts recommend you avoid using Remote Desktop Services all together.
|
|
Hackers take advantage of the trust and access MSPs have earned from clients.
Managed service providers (MSPs) are trusted by millions of businesses to keep their computers and networks safe from intrusion. The trust and access MSPs have earned from clients have actually become vulnerabilities, as hackers have set their sights on the MSPs themselves.
Remote access to their clients' networks makes MSPs a smart target for ransomware attackers, and they are making the most of it. In one recent example, a mid-sized MSP was hacked and used to distribute the cryptolocking ransomware GandCrab to 80 of the MSP's clients.
In addition to the economies of scale (e.g., attack one company, the MSP, reach 80 others, the MSP's clients), the ransomware actors may be drawn to a couple of software solutions commonly used by MSPs. Certain customer relationship management and ticketing solutions have been called out as possible points of entry for the hackers.
This circumstance is a terrific reminder of just how important it is to understand the risks presented by third-parties. Every company, regardless of its size, should practice good vendor management. Here are just a few of the basics I recommend organizations employ to protect their organizations against the threat of a vulnerable third-party product or service provider:
- Create a template of standard information security and privacy contract clauses. Contracts should be customized for each vendor, but it's helpful to have a place to start.
- Establish and communicate a clear and documented breach notification process for the vendor to follow after a security incident. Include notification time requirements.
- Require monthly or quarterly security and privacy attestations from your high-risk vendors' executive management.
- Do not require a vendor to use an assessment that will cost more for the vendor to take than the amount you are paying them for their work or service.
- Be wary of assessments that claim "certified compliance." Compliance levels vary on an ongoing basis as changes in the business environment occur, new threats and vulnerabilities are discovered, and as new legal requirements arise. There is no such thing as "Certified 100% Compliance" or similar claims.
- Verify you are named as an insured on the vendor's security and privacy liability insurance.
- Make sure your cyber liability policy covers losses related to security events at a vendor (Contractors are often not covered.).
WANT MORE? Email me for a 6-page document listing more vendor oversight and risk management tips. Happy to send it, no charge!
|
|
|
Amazon Back in Hot Water Over Alexa Recordings
|
An 8-year-old plaintiff is suing the company over privacy violations.
| | | |
