The U.S. Federal Bureau of Investigation (FBI) this week warned about a “dramatic” increase in so-called “CEO fraud,” e-mail scams in which the attacker spoofs a message from the boss and tricks someone at the organization into wiring funds to the fraudsters. The FBI estimates that these scams have cost organizations more than $2.3 billion in losses over the past three years.
FBI officials are warning potential victims of a dramatic rise in the business e-mail compromise scam or “B.E.C.,” a scheme that targets businesses and has resulted in massive financial losses in Phoenix and other cities.
The schemers go to great lengths to spoof company e-mail or use social engineering to assume the identity of the CEO, a company attorney, or trusted vendor. They research employees who manage money and use language specific to the company they are targeting, then they request a wire fraud transfer using dollar amounts that lend legitimacy.
There are various versions of the scams. Victims range from large corporations to tech companies to small businesses to non-profit organizations. Many times, the fraud targets businesses that work with foreign suppliers or regularly perform wire transfer payments.
Tips for Businesses:
◾Be wary of e-mail-only wire transfer requests and requests involving urgency
◾Pick up the phone and verify legitimate business partners.
◾Be cautious of mimicked e-mail addresses
◾Practice multi-level authentication.
Article and images reposted from krebsonsecurity.com
If you use an Apple iPhone, iPad or other iDevice, now would be an excellent time to ensure that the machine is running the latest version of Apple’s mobile operating system — version 9.3.1. Failing to do so could expose your devices to automated threats capable of rendering them unresponsive and perhaps forever useless.
Reported earlier by respected security researcher Brian Krebs, Manually setting the date of your iPhone or iPad all the back to January. 1, 1970 will permanently brick the device (don’t try this at home, or against frenemies!).
Apple products like the iPad (and virtually all mass-market wireless devices) are designed to automatically connect to wireless networks they have seen before. They do this with a relatively weak level of authentication: If you connect to a network named “Hotspot” once, going forward your device may automatically connect to any open network that also happens to be called “Hotspot.”
For example, to use Starbuck’s free Wi-Fi service, you’ll have to connect to a network called “attwifi”. But once you’ve done that, you won’t ever have to manually connect to a network called “attwifi” ever again. The next time you visit a Starbucks, just pull out your iPad and the device automagically connects.
From an attacker’s perspective, this is a golden opportunity. Why? He only needs to advertise a fake open network called “attwifi” at a spot where large numbers of computer users are known to congregate. Using specialized hardware to amplify his Wi-Fi signal, he can force many users to connect to his (evil) “attwifi” hotspot. From there, he can attempt to inspect, modify or redirect any network traffic for any iPads or other devices that unwittingly connect to his evil network.
Read the full article at kerbsonsecurity.com/
Reposted from the FTC Consumer Information Blog
Many poeple don’t think twice about their wireless router after setting it up. And it might be tempting to rush through the set-up process. Here’s why you should pay close attention while setting up your router, and afterwards.
Heard of ASUSTeK? Among other things, they sell ASUS-branded wireless routers for home use. Some of their routers come with features — called AiCloud and AiDisk — that allow people to attach a hard drive to their routers and create their own “cloud” storage. According to the FTC’s complaint, ASUS routers had major security flaws that allowed hackers to harm consumers in several ways, including getting access to sensitive personal information — like tax documents — that people stored through these “cloud” services.
If you have an ASUS router, take these steps right away:
- Download the latest security updates for your router. According to the FTC, the ASUS router update tool often indicated that software was current when it wasn’t, putting people’s home networks at risk. Moving forward, ASUS is required to provide accurate information about software updates. So check the router’s software update tool and the ASUS support site again for the newest security updates.
- Check if access to your network storage is limited. Make sure access to AiCloud and AiDisk is limited to what you want. The FTC took issue with the default option during AiDisk’s set-up, which gave anyone on the Internet access to your storage. For more privacy, choose “limited” or “admin rights” access instead of “limitless.”
- Change pre-set passwords. According to the FTC, ASUS pre-set weak default passwords on every router. So create new passwords that are strong and unique for both your router and any “cloud” services — something only you know. This can help prevent hackers from getting easy access to your network.
If you need professional advice or assistance in securing your business networks, contact CS2K today.
Microsoft will be pulling the plug on Internet Explorer 8,9 and 10 next week. The company has announced a final patch which will deliver the last few bug fixes to Internet Explorer on January 12th 2016, as well as an “End of Life” notification telling users to upgrade to IE11 or Microsoft Edge. This should be no surprise since March 2015 IE has been deprecated, mostly sticking around for the sake of enterprise compatibility.
If you are still using Internet Explorer 8, 9 or 10 for your business applications contact CS2K to discuss your options including migrating your application or switching to a modern browser.
Source – Microsoft KB
Microsoft continues to warn that scammers are calling Windows users and duping them into putting malware on their machines or paying for worthless help.
More than a year after the U.S. Federal Trade Commission (FTC) heralded a major crackdown on fraudsters posing as Microsoft technical support personnel, consumers continue to receive calls from scammers. Since 2011 Microsoft has been tracking this con and reports that 22% of people called by phony support technicians fall for their scam.
The scammers try to trick users into believing that their computer is infected — often by having them look at a Windows log that typically shows scores of harmless or low-level errors — then convince them to download software or let the “technician” remotely access the PC. The con artists charge for their “help” and often get people to pay for worthless software. In actuality, the software is malware that steals online account information and passwords.
If you have fallen victim to this scam, please do not hesitate to contact CS2K to discuss your best options.
You can learn more about this and some tips directly at Microsoft’s website – http://www.microsoft.com/security/online-privacy/msname.aspx or in the original Computer World Reports
Microsoft has reported that later today it will make available and emergency security update to fix the now famous zero day vulnerability found in all versions of Internet Explorer. This was expected but most unexpectedly, Microsoft will also be making the fix available to Windows XP which is no longer supported since April.
CS2K will test this update as soon as it is made available and will prepare a deployment plan over the weekend.
In a rare move that highlights the severity of a security hole in Internet Explorer, US Computer Emergency Readiness Team (CERT) says some IE users may want to “consider employing an alternate browser” till flaw is patched.
The zero-day exploit (a term given to a previously unknown, unpatched flaw) allows attackers to install malware on your computer without your permission. That malware could be used to gain control of your computer. The exploit is present in Internet Explorer 6 and above.
Please consult with CS2K to determine if you should be switching to FireFox, Chrome or employing one of these temporary workarounds suggested by Microsoft
Original US-CERT Article
Hopefully you have followed advice and ditched Windows XP in favor of a more modern operating system, because there’s a new security exploit that’ll leave XP users exposed.
In a security alert released on Saturday, Microsoft reports that there’s a serious vulnerability in Internet Explorer 6 through 11 that could allow hackers to take over your computer remotely if you happen to visit a malicious website.
According to reports, security researchers has already found evidence of an attack that targets IE 9 through 11 that uses a well-known Flash exploitation technique to gain access to your computer’s memory. Microsoft has already said it plans to roll out an IE security update for all modern versions of Windows, but if you’re using XP, well, you’re out of luck, as support for that OS ended a few weeks ago.
After a natural disaster phishing emails and websites requesting donations for bogus charitable organizations begin to appear. Users should be aware of potential email scams and phishing attacks regarding the recent Philippines Typhoon disaster. Email scams may contain links or attachments which may direct users to phishing or malware-laden websites.
CS2K and US-CERT encourages users to take the following measures to protect themselves:
Contact CS2K today for your complimentary site analysis. We will help you determine the weaknesses in your own network security.