About emorales

This author has not yet filled in any details.
So far emorales has created 41 blog entries.

Microsoft: Application Inspector is now open source, so use it to test code security

By Liam Tung | January 17, 2020 — 14:05 GMT (06:05 PST) | Topic: Enterprise Software

Microsoft has released the Microsoft Application Inspector, a cross-platform open-source command-line tool that its engineers use to quickly probe third-party open-source software components for security issues.

The static source-code analyzer aims to help developers handle potential security issues that arise through code reuse when incorporating open-source components, such as software libraries, into a project.

“Reuse has great benefits, including time to market, quality, and interoperability, but sometimes brings the cost of hidden complexity and risk,” write Guy Acosta and Michael Scovetta, members of Microsoft’s Customer Security and Trust team.

“You trust your engineering team, but the code they write often accounts for only a tiny fraction of the entire application. How well do you understand what all those external software components actually do?”

As they note, modern web applications often have hundreds of third-party components that contain tens of thousands of lines of code, which were written by thousands of contributors. And typically developers who use those components rely on the author’s description, which Microsoft argues is not reliable or enough to meet Microsoft’s responsibility for shipping secure code, which includes external components.

Microsoft argues Application Inspector is a unique static code analyzer because it doesn’t flag ‘good’ or ‘bad’ patterns but rather highlights ‘interesting’ features in a report based on over 500 rule patterns. The idea is that the tool can help identify these interesting characteristics more quickly than manual introspection.

The tool targets features of software components that affect security, such as the use of cryptography, components that connect to a remote entity such as a public cloud, and the platforms it runs on.

Application Inspector is built on .NET Core, which means it can be used by developers on Windows, Linux or macOS.

“Application Inspector’s primary objective is to identify source-code features in a systematic and scalable way not found elsewhere in typical static analyzers. This enables developer and security professionals to validate purported component objectives, eg, a string padding library only does what it says,” Microsoft explains in a wiki.

The tool can analyze millions of lines of source code from components that are built in multiple popular programming languages.

Application Inspector produces a browser-based report that summarizes the major characteristics identified, including application frameworks, cloud interfaces, cryptography, sensitive data like access keys, personally identifiable information, operating system functions, and security features.

But the company stresses that Application Inspector doesn’t remove the need for security code review or a security static analyzer. However, it could be a useful addition for developers facing tight deadlines.

Acosta recently demonstrated Application Inspector at the SecTor conference in Canada.

Each icon in the report represents a feature that Application Inspector identified in the source code.Image: Microsoft

emorales2020-02-22T20:24:05-05:00January 17th, 2020|Cyber News|

FILE - In this Jan. 11, 2010 file photo, a display for Microsoft's Windows 7 is shown at the National Retail Federation's convention in New York. Users still running Microsoft's Windows 7, on their computer's might be at risk. Microsoft is no longer providing free security updates for the system as of Tuesday, Jan. 14, 2020, meaning computers using it will be more vulnerable to viruses and malware. Users who want to protect their data need to upgrade to Windows 10. (AP Photo/Mark Lennihan, File) — FILE – In this Jan. 11, 2010 file photo, a display for Microsoft’s Windows 7 is shown at the National Retail Federation’s convention in New York. Users still running Microsoft’s Windows 7, on their computer’s might be at risk. Microsoft is no longer providing free security updates for the system as of Tuesday, Jan. 14, 2020, meaning computers using it will be more vulnerable to viruses and malware. Users who want to protect their data need to upgrade to Windows 10. (AP Photo/Mark Lennihan, File)

Microsoft will stop providing free security updates for the system on Tuesday, meaning computers using it will be more vulnerable to malware and hacking.

Users who want to protect their computers need to upgrade to Windows 10. They may also need to buy new computers because older machines might not be compatible with Windows 10.

Tech companies typically phase out older systems after a number of years and focus efforts on updating current versions of software. Windows 7 came out in 2009. Windows 8, which came out in 2012, will have free support end in 2023.

Windows 10 starts at $139 for a basic, “Home” version. Microsoft charges $200 for a “Pro” version meant for businesses and individuals who need its advance features. Windows 10 comes with regular free updates for security and additional features. Although Windows 10 isn’t likely to be phased out anytime soon, older versions will require those updates to keep working.

Microsoft is also ending support Tuesday for Windows Server 2008 or 2008 R2 operating systems.

Those who run Windows 7 Professional or Windows 7 Enterprise can buy extended protection for up to three years. But it might be worthwhile to just to buy new PCs or get Windows 10.

Microsoft will also be ending support on Oct. 13 for Office 2010 a package that includes word processing and spreadsheet software. Owners need to explore newer versions of Office, including a subscription offering called Office 365.

The Telegraph

GCHQ warns not to use Windows 7 computers for banking or email after Tuesday

Microsoft is stopping support for Windows 7 from Tuesday - Getty Images North America — Microsoft is stopping support for Windows 7 from Tuesday – Getty Images North America

GCHQ has warned people not to do internet banking or use emails from computers with Windows 7 from Tuesday, when Microsoft will end support for the software.

The National Cyber Security Centre (NCSC), the public-facing arm of the cyber spy agency, said that devices still using the operating system after next week will become increasingly vulnerable to cyber attacks as the tech giant stops patching weaknesses in its product.

Microsoft announced last year that it would be ceasing technical support for Windows 7 and urged users to upgrade to its Windows 10 system, which costs £120.

It is estimated that there are still more than 440 million people using Windows 7 worldwide, which was first released in 2009.

A spokesperson for the NCSC said: “The NCSC would encourage people to upgrade devices currently running Windows 7, allowing them to continue receiving software updates which help protect their devices.

“We would urge those using the software after the deadline to replace unsupported devices as soon as possible, to move sensitive data to a supported device and not to use them for tasks like accessing bank and other sensitive accounts.

“They should also consider accessing email from a different device.”

The national security agency warned that after Microsoft stopped supporting Windows XP in 2014 that hackers soon started exploiting weaknesses in the system.

Among the risks users run are having their computers infected with malware, which can steal sensitive details such as financial and banking information from their device.

The NCSC spokesman added: “As a result, it’s crucial to move away from them as quickly as possible.”

The Windows 7 operating system has previously been caught up in security lapses. In 2017, most of the NHS computers infected by the WannaCry ransomware attack, which caused almost 19,500 hospital appointments – including cancer referrals – to be cancelled, were found to be using the operating system.

However, report into the hacking, which affected 81 trusts in England and Wales, found that many of the systems had not been updated by NHS groups leaving them more vulnerable to cyber attack.

Microsoft said it will be providing security support for three more years to businesses using Windows 7 and for customers who are willing to pay for an upgraded package of updates.

However, the company itself warned users they would be at greater risk of hacking malware if they continued to use Windows 7 after Tuesday.

A Microsoft spokesman said: If you continue to use an unsupported version of Windows, your PC will still work, but it will become more vulnerable to security risks and viruses.

“Your PC will continue to start and run, but you will no longer receive software updates, including security updates, from Microsoft.”

emorales2020-02-22T19:31:30-05:00January 13th, 2020|Cyber News|

Watch Out For Fake Apps.

Beware! Scammers are now creating fake apps. They trick you into downloading them to your smartphone or tablet, and ask you to load your credit card information in these apps. You can guess what happens next.

Here are 5 things to keep in mind about this Scam of The Week:

Be very judicious in deciding what app to download. Better safe than sorry.
If you *do* decide to download an app, check the reviews first; apps with few reviews or bad reviews are a big Red Flag.
If you receive an email with a link to download a new app, don’t click it. Always go directly to the website of the retailer to download software, or use the AppStore or Google Play.
Don’t link your credit card or give out any personal information to a program unless you are certain you’re dealing with a verified vendor.

emorales2020-02-25T16:43:48-05:00December 11th, 2019|Cybersecurity Tips|

What ‘deepfakes’ are and how they may be dangerous

Grace Shao @GRACEMZSHAO

KEY POINTS

Anybody who has a computer and access to the internet can technically produce a “deepfake” video, says John Villasenor, professor of electrical engineering at the University of California, Los Angeles.
“The technology can be used to make people believe something is real when it is not,” said Peter Singer, cybersecurity and defense focused strategist and senior fellow at New America.

A comparison of an original and deepfake video of Facebook CEO Mark Zuckerberg.

Elyse Samuels | The Washington Post | Getty Images

Camera apps have become increasingly sophisticated. Users can elongate legs, remove pimples, add on animal ears and now, some can even create false videos that look very real. The technology used to create such digital content has quickly become accessible to the masses, and they are called “deepfakes.”

Deepfakes refer to manipulated videos, or other digital representations produced by sophisticated artificial intelligence, that yield fabricated images and sounds that appear to be real.

Such videos are “becoming increasingly sophisticated and accessible,” wrote John Villasenor, nonresident senior fellow of governance studies at the Center for Technology Innovation at Washington-based public policy organization, the Brookings Institution. “Deepfakes are raising a set of challenging policy, technology, and legal issues.”

https://www.cnbc.com/video/2019/09/29/deepfake-threats-and-how-facebook-twitter-and-google-try-to-stop-them.html

The rise of deepfakes and how Facebook, Twitter and Google work to stop them

In fact, anybody who has a computer and access to the internet can technically produce deepfake content, said Villasenor, who is also a professor of electrical engineering at the University of California, Los Angeles.

What are deepfakes?

The word deepfake combines the terms “deep learning” and “fake,” and is a form of artificial intelligence.

In simplistic terms, deepfakes are falsified videos made by means of deep learning, said Paul Barrett, adjunct professor of law at New York University.

Deep learning is “a subset of AI,” and refers to arrangements of algorithms that can learn and make intelligent decisions on their own.

But the danger of that is “the technology can be used to make people believe something is real when it is not,” said Peter Singer, cybersecurity and defense-focused strategist and senior fellow at New America think tank.

Singer is not the only one who’s warned of the dangers of deepfakes.

Villasenor told CNBC the technology “can be used to undermine the reputation of a political candidate by making the candidate appear to say or do things that never actually occurred.”

“They are a powerful new tool for those who might want to (use) misinformation to influence an election,” said Villasenor.

How do deepfakes work?

A deep-learning system can produce a persuasive counterfeit by studying photographs and videos of a target person from multiple angles, and then mimicking its behavior and speech patterns.

Barrett explained that “once a preliminary fake has been produced, a method known as GANs, or generative adversarial networks, makes it more believable. The GANs process seeks to detect flaws in the forgery, leading to improvements addressing the flaws.”

And after multiple rounds of detection and improvement, the deepfake video is completed, said the professor.

According to a MIT technology report, a device that enables deepfakes can be “a perfect weapon for purveyors of fake news who want to influence everything from stock prices to elections.”

In fact, “AI tools are already being used to put pictures of other people’s faces on the bodies of porn stars and put words in the mouths of politicians,” wrote Martin Giles, San Francisco bureau chief of MIT Technology Review in a report.

He said GANs didn’t create this problem, but they’ll make it worse.

How to detect manipulated videos?

While AI can be used to make deepfakes, it can also be used to detect them, Brookings’ Villasenor wrote in February. With the technology becoming accessible to any computer user, more and more researchers are focusing on deepfake detection and looking for a way of regulating it.

Large corporations such as Facebook and Microsoft have taken initiatives to detect and remove deepfake videos. The two companies announced earlier this year that they will be collaborating with top universities across the U.S. to create a large database of fake videos for research, according to Reuters.

“Presently, there are slight visual aspects that are off if you look closer, anything from the ears or eyes not matching to fuzzy borders of the face or too smooth skin to lighting and shadows,” said Singer from New America.

But he said that detecting the “tells” is getting harder and harder as the deepfake technology becomes more advanced and videos look more realistic.

Even as the technology continues to evolve, Villasenor warned that detection techniques “often lag behind the most advanced creation methods.” So the better question is: “Will people be more likely to believe a deepfake or a detection algorithm that flags the video as fabricated?”

emorales2020-02-22T20:16:07-05:00October 24th, 2019|Cyber News, Cybersecurity Tips|

Author:Tara Seals

October, 2019

A worm with a randomized propagation method is spreading via the popular container technology.

The Docker cloud containerization technology is the target for a just-discovered cryptojacking worm dubbed Graboid.

According to researchers at Palo Alto’s Unit 42, the worm, which looks to mine the Monero cryptocurrency, has infected more than 2,000 unsecured Docker Engine (Community Edition) hosts so far, which are in the process of being cleaned. These are located mainly in China and the U.S. The Graboid malware is named after the sandworms in the 1990 Kevin Bacon movie, Tremors.

Overall, the initial malicious Docker image has been downloaded more than 10,000 times, with the worm itself downloaded more than 6,500 times, according to Unit 42. Administrators can spot infections by looking for the presence of an image called “gakeaws/nginx” in the image build history.

“The malicious actor gained an initial foothold through unsecured Docker daemons, where a Docker image [containing a Docker client tool used to communicate with other Docker hosts] was first installed to run on the compromised host,” the researchers wrote in a Wednesday post, adding that without any authentication or authorization, a malicious actor can take full control of the Docker Engine and the host.

Once the malicious Docker container is up and running, it downloads four different scripts and a list of vulnerable and infected hosts from one of its 15 command-and-control (C2) servers. Then, it randomly picks three targets, installing the worm on the first target, stopping the miner installed on a second infected host, and starting the miner on a third, also already-infected, target.

“This procedure leads to a very random mining behavior,” the researchers explained. “If my host is compromised, the malicious container does not start immediately. Instead, I have to wait until another compromised host picks me and starts my mining process. Other compromised hosts can also randomly stop my mining process. Essentially, the miner on every infected host is randomly controlled by all other infected hosts. The motivation for this randomized design is unclear.”

From a technical perspective, the entry point script /var/sbin/bash in the pocosow/centos container downloads four shell scripts from the C2 and executes them one by one. The downloaded scripts are named live.sh, worm.sh, xmr.sh and cleanxmr.sh.

The live.sh script sends the number of available CPUs on the compromised host to the C2; worm.sh is responsible for choosing a new vulnerable host to infect; cleanxmr.sh chooses an infected host to stop cryptojacking on; xmr.sh starts the mining on an infected host; and cleanxmr.sh stops the cryptojacking container as well as any third-party XMRig-based containers that are present.

In a worm simulation using a potential victim pool of 2,000, the researchers found that the worm can reach 70 percent of them (1,400 vulnerable hosts) in about an hour. Further, each miner is active 63 percent of the time and each mining period lasts for 250 seconds; so, in the simulation, researchers showed that there are an average of 900 active miners at any time given a compromised cluster of 1,400 hosts.

The cryptojacking effort itself is not as efficient nor as effective as it could be, according to Unit 42 researchers (much like the graboids in Tremors, “it moves in short bursts of speed, but overall is relatively inept,” they said) – but the malware does pave the way for more destructive attacks down the road.

“While this cryptojacking worm doesn’t involve sophisticated tactics, techniques or procedures, the worm can periodically pull new scripts from the C2s, so it can easily repurpose itself to ransomware or any malware to fully compromise the hosts down the line and shouldn’t be ignored,” they wrote. “If a more potent worm is ever created to take a similar infiltration approach, it could cause much greater damage, so it’s imperative for organizations to safeguard their Docker hosts.”

This isn’t the first time that crypto-crooks have targeted Docker for mining. In June 2018, Kromtech Security Center researchers found 17 malicious Docker containers that earned cryptomining criminals $90,000 in 30 days – at the time, they called the campaign a harbinger of things to come and warned that containers are shaping up to be the next ripe target for these types of criminals.

Container technologies like Docker are increasingly of interest to cybercriminals given that traditional security tools often don’t peer inside to look for malicious code. Also, they can often be left unsecured and open to the internet. According to research from Lacework last year, most containers (Kubernetes, Mesos, Docker and more) suffer from poorly configured resources, lack of credentials and the use of non-secure protocols. As a result, attackers can remotely access the infrastructure to install, remove or encrypt any application that the company is running in the cloud.

“Securing your containers is important, but this type of attacks demonstrates that you can’t ignore the infrastructure supporting those containers either,” Tim Erlin, vice president of product management and strategy at Tripwire, said via email. “DevOps tends to favor velocity over security, but when you have to stop what you’re doing to address an incident like this, you’re losing the velocity gains you might have experienced by leaving security out of the DevOps lifecycle. Addressing security through incident response is the most expensive method to employ.”

emorales2020-02-22T19:31:30-05:00October 24th, 2019|Cyber News|

Twitter CEO Jack Dorsey was hacked Friday. Here’s how to safeguard your Twitter account

By Shannon Liao, CNN Business

Updated 3:52 PM ET, Sat August 31, 2019

New York (CNN)The hack of Twitter CEO Jack Dorsey’s account on Friday revealed a flaw in the social network’s systems that could leave anyone vulnerable, from lawmakers to CEOs to the average Twitter user. And it raised a serious question as to how you can keep your account safe from the same thing.

Dorsey was likely a victim of SIM swapping, a practice in which a hacker will bribe or otherwise convince a mobile carrier employee to switch a phone number to the hacker’s device.

“Somebody can just get somebody making $12 an hour and offer them a thousand dollars to do a SIM swap,” Brian Krebs, a leading cybersecurity journalist, told CNN Business on Saturday.

Thanks to a feature left over from Twitter’s early days, if a hacker gets control of the phone number associated with your Twitter account, they can text any tweets they want to Twitter’s number, 40404, and they’ll be immediately published to your account. The hacker wouldn’t need any other verification — not even your account password.

Asked by CNN Business on Saturday, Twitter declined to comment on whether it would change its security practices following the Dorsey incident.

Our lax cybersecurity policies put our elections and our data at risk

Until it does, there doesn’t appear to be any real way to turn off the feature that the hacker or hackers apparently exploited to take over Dorsey’s account. The only way to do it actually involves making your account less safe overall. But there are still some things you can do to protect your account from these kinds of attacks.

Verification codes

First off, it’s a good idea to always have two-factor authentication on, as an additional verification step to confirm your identity beyond your regular password. But even two-factor won’t protect you from a SIM swapping hack.

Not all verifications are made equal. A hacker can intercept security codes sent via text message, rendering it useless.

Luckily, Twitter offers several more secure verification methods.

One step better would be to use the Google Authenticator phone app, which will provide you codes. A hacker would then need your actual phone to get the codes. Or you can use a physical security token, a small piece of hardware you can buy separately that generates security codes. A hacker would typically need to physically steal that key to gain access to an account.

Replace your phone number

Right now it appears that the only way to shut off the ability to use text messages to send a tweet from your account is to delete your phone number from Twitter entirely. But there’s a catch: Doing so will disable two-factor authentication on your account. I tried multiple times to keep two-factor enabled on my own Twitter account while deleting my phone number from it. Each time it appeared Twitter would allow me to do so, but when I refreshed the page, two-factor was off.

What you can do instead, if you’re in the United States, is to try replacing your phone number with a number generated by Google Voice, as first suggested on Twitter by Krebs. A Google Voice phone number isn’t managed by a mobile carrier and doesn’t have anyone a hacker could talk into helping them obtain control of your number.

“You can’t get somebody from Google Voice on the phone if you tried,” Krebs told CNN Business.

It’s not a perfect solution, Krebs said, as your Google account could also get hacked via SIM swapping if you’re set to receive text messages for two factor authentication for that account. And anyone outside the United States will need to find an alternative service. But it would still be effective if you enable an alternative verification method on your Google account and follow other generally good security procedures like setting very strong, unique passwords for all the sites you use, and using a password manager to keep track of them.

CNN’s Kevin Collier contributed to this report.

emorales2020-02-22T20:16:07-05:00September 3rd, 2019|Cyber News, Cybersecurity Tips|

Criminals armed with personal information are creating crafty schemes to defraud consumers out of their hard-earned money

By Octavio Blanco

August 21, 2019

Illustration of a robot on a smartphone.

It took two phone calls to rob an 81-year-old woman of her $80,000 life savings.

The first came from a man claiming to be from the Social Security Administration. The woman thought the call was legitimate because her ID screen displayed the agency’s phone number. Plus the man knew her name and had her Social Security information.

The man said there was a problem with her account, and unless she immediately wired him the money to fix it, her benefits would be cut off. She agreed to send him the funds.

Soon after, she got a call from an accomplice claiming to be an FBI officer. He told the woman that the first caller was an imposter and had cheated her. He then convinced her that he needed money to go after the con man. She agreed to wire him funds as well. Now, in the twilight of her life, she has lost everything.

This is just one of thousands of so-called imposter scams reported each year that target people in the U.S., particularly older ones.

While overall robocall fraud complaints have been declining, the Federal Trade Commission, one of the government entities that regulates the telephone industry, says complaints about scams like the one described above are surging. In May of this year alone, the FTC says it received 46,000 impostor scam complaints.

Criminals Know More About You

Imposter scams are rising because criminals are doing more research—especially on social media—to target and earn the trust of victims they think might result in a big payday.

“Our older adults didn’t grow up with the internet, like I might have, and are really excited to be on there and to be able to share things,” Nofziger says. “But everybody is putting way too much information out on social media, regardless of if you’re in your 50s or under the age of 50.”

She says it’s important that people have their security settings and their social media profiles locked down, and to understand that otherwise, anyone can have access to what we’re sharing online.

Easily available personal information, whether stolen in a data breach or from poorly secured social media accounts, helps criminals add credibility to their cons.

“Robocall scammers know more about you, so they’re targeting you specifically,” says Al Pascual, chief operating officer and co-founder at Breach Clarity, a firm that helps consumers to understand the threat level of a data breach and what steps they need to take to be protected. “They pretend to be a family member in need of money or use other creative ways to get you to pay up.”

And while the elderly are often targeted in these attacks, people of all ages are at risk. The FTC says that consumers under the age of 60 report losing money at higher rates than consumers over that age. But the elderly are still the prime targets because, according to the FTC, older victims tend to lead to bigger paydays for crooks.

4 Popular Phone Scams

There’s a nearly endless variety of frauds being perpetrated. Here are a few of the most popular ones for which you should be on the alert.

The Tech Support Scam

How it works: In this scam, robocallers contact victims impersonating an IT customer service rep, saying there’s a problem with your Apple ID, Microsoft account, or cable company account information. In this fraud, the number is spoofed to make the call look like it’s coming from the company’s 800 number. The caller may even have your name and an old password of yours. Once you’re hooked, they’ll send you to a fake website to steal your money or collect your personal information, or they may fool you into giving it to them directly over the phone. A favorite method is to ask their target to pay using a gift card, which victims will often purchase at a drugstore. Victims will either input the card’s information into a fake website or give the card’s details to the crook over the phone. The scammers then quickly redeem the card’s value.

“We’ve definitely been seeing a high volume of calls purporting to be from the main numbers of tech companies like Apple and Microsoft being used; that’s definitely a trend,” says Jim Tyrrell, senior director of product marketing at Transaction Network Services, which provides robocall detection for big telecom companies, such as Verizon and Sprint. “We’ve seen high-risk calls increase by double digits over the last six months,” he says.

Family Emergency Scam

How it works: Scammers pose as relatives or friends calling in an emergency. By dredging your social media account, they can learn your family relationships, pet names, latest travels, and more. In this scam, once the crooks have the information, they’ll call you, making it seem like a family member, such as a grandchild who may be traveling abroad, is in a faraway jail or in the hospital and in urgent need of emergency funds. The element of urgency can trick you into sending money before you realize it’s a scam. And while you normally might recognize the voice of family members, there are some you may not have spoken to in a long time. Often, crooks ask the victim to keep it secret, preventing victims from checking with other family members about the supposed crisis.

Government Imposter Scam

How it works: It’s one of the most prevalent frauds today. In this scam, criminals use phone number spoofing technology to fraudulently make a government agency’s phone number appear on victims’ phones to fool victims into believing that the IRS or Social Security Administration is calling seeking payment. Crooks often have your name, Social Security number, or other personal information. In the IRS scam, they may threaten to arrest or deport you, or revoke your license if you don’t pay right away. With the Social Security scam, they often say your benefits are blocked and can be reactivated for a fee.

Medicare Scam

How it works: Scammers call pretending that they’re Medicare representatives or that they’re from a medical supply company. Often they are looking for your personal information and will say they need your Medicare number so that you can get a back or neck brace. Sometimes the scammers will call offering free services or equipment in exchange for your Medicare information. They may say they need your information or money so that you can get a new Medicare card and that if you don’t act quickly, you’ll be hit with fees.

Tools to Protect You

Scary as the threat may seem, there are technological and behavioral tools that may help reduce your susceptibility to being defrauded by robocall phone scams.

To help protect consumers, some phone service providers are rolling out new call authentication technology called Shaken/Stir and are working with software developers to improve analytics and artificial intelligence algorithms that monitor suspicious activity on their networks to more aggressively block unwanted calls from reaching consumers.

“We’re working with the carriers to build out technology to protect their subscribers,” says Gavin Macomber, senior vice president at First Orion, the robocall blocking firm that powers T-Mobile’s tools. “Their customers, overwhelmed by the amount of unwanted phone calls they receive—especially those that are looking to scam them—are putting more of the responsibility onto the carriers to protect them.”

AT&T and Verizon are also working with robocall blocking firms to improve their security.

“Now many carriers are offering blocking at the network level,” says the FTC’s Barlow. “So we really urge consumers to investigate what’s available for them.”

But not all consumers are equally protected, especially those with traditional copper landlines from small providers that haven’t yet switched over to a digital network.

“Too many of these robocalls are from scammers intending to do consumers harm,” says Maureen Mahoney, policy analyst at CR. “While there are an increasing number of effective anti-robocall tools for cell-phone users and consumers with advanced home phone lines, those with traditional landlines have limited options to protect themselves, and they can be costly. That’s why phone companies need to be required to implement effective anti-robocall technology for all phone customers, at no charge.”

How to Protect Yourself

Hang up. Don’t engage with any robocallers; it can just end up in more calls.
Don’t trust caller ID. Scammers can make it look like their calls are coming from trusted institutions.
Don’t pay anyone who calls you over the phone. If you get a call trying to get you to pay money, it’s almost certainly an unlawful robocall.
Never pay by wire transfer, gift card, or prepaid card over the phone. No legitimate company or government agency is asking to be paid with Amazon, Google Play, or iTunes gift cards.
Resist the urge to act immediately, no matter how dramatic the story is.
Report scam calls to the FTC at donotcall.gov or by calling 877-382-4357. The more data the agency has, the more it can focus on enforcement, Barlow says.
Register for the Do Not Call Registry. This may not reduce calls from criminals who ignore the registry, but it will reduce calls from the lawful companies.

emorales2020-02-22T20:16:07-05:00August 22nd, 2019|Cyber News, Cybersecurity Tips|

Tipster’s Email Led to Arrest in Massive Capital One Breach

Christian Berthelsen, William Turton and Jenny Surane /

BloombergJuly 30, 2019

(Bloomberg) — Capital One Financial Corp. set up an email address for tipsters — including “white hat” hackers — to alert the company to potential vulnerabilities in its computer systems. On July 17, the company got a hit.

“Hello there,” the email said, according to federal prosecutors. “There appears to be some leaked s3 data of yours in someone’s github/gist.” A link was provided to an account at GitHub, a company that allows users to manage and store project revisions, mostly related to software development.

It didn’t take Capital One long to figure out who had accessed its files. The GitHub address included a name, Paige Thompson, a former Amazon.com Inc. employee who used the online nickname “erratic” and discussed her exploits with others, according to federal prosecutors.

“I’ve basically strapped myself with a bomb vest, (expletive) dropping capitol ones dox and admitting it,” Thompson allegedly wrote, under the “erratic“ alias, in a June 18 Twitter message. “There ssns…with full name and dob” — an apparent reference to Social Security numbers.

Damage Assessment

It also didn’t take Capital One much time to assess the damage. On Monday, it announced that about 100 million people in the U.S. had been impacted by the breach, and another 6 million in Canada. The illegally accessed data, which was stored on servers rented from Amazon Web Services, was primarily related to credit card applications and included personal information, like names, addresses and dates of birth, and some financial information, including self-reported income and credit scores.

Most Social Security numbers were protected, but about 140,000 were compromised, the bank said. Capital One said it was “unlikely that the information was used for fraud or disseminated by this individual.”

The company described the tipster to the hack as an “external security researcher.”

Thompson, 33, was charged with computer fraud and abuse. In a court hearing Monday, she broke down and laid her head on the defense table. On Tuesday, New York Attorney General Letitia James announced that her office is opening an investigation into the Capital One breach.

The scale of the breach ranks it as possibly one of the largest-ever impacting a U.S. bank, although the consequences may be limited if the data wasn’t distributed to others or used for fraud.

Capital One shares fell as much as 6.5% Tuesday morning, their biggest decline in six months.

Security Lapses

The breach shows how hackers can steal vast troves of consumer data as the result of lapses made by the companies that collect it. In 2017, Equifax Inc. failed to patch a known flaw in its servers, resulting in the theft of 145 million Social Security numbers, along with the names and dates of birth of possibly a third of the U.S. population.

In the Capital One case, Thompson was allegedly able to steal vast buckets of personal data because of an improperly configured firewall — among the most basic digital security tools. The bank said it immediately fixed the problem once it was discovered.

In a complaint filed Monday in Seattle, prosecutors said that Thompson accessed the data at various times between March 12 and July 17. A file on her GitHub account, timestamped April 21, contained a list of more than 700 folders and buckets of data, according to prosecutors.

The Capital One data had been stored on servers it contracted from a cloud computing company that isn’t identified, though the charges against Thompson refer to information stored on S3, a reference to Amazon Web Services’ popular data storage software.

An AWS spokesman confirmed that the company’s cloud had stored the Capital One data that was allegedly stolen, and said it wasn’t accessed through a breach or vulnerability in its systems.

Cloud Advocate

Capital One has been one of the most vocal advocates for using cloud services among banks. The lender has said it is migrating an increasing percentage of its applications and data to the cloud and plans to completely exit its data centers by the end of 2020. The move will help lower costs, the company has said.

The lender has been the subject of several case studies published by Amazon Web Services that noted the cloud services provider has helped the company develop new technologies faster and improve certain services including its call center.

“We have embraced the public cloud and are well on our way to migrating our applications and data to the cloud,” Chief Executive Officer Richard Fairbank told analysts on a conference call in April. “We are now considered one of the most cloud forward companies in the world.”

Thompson, previously an Amazon Web Services employee, last worked at Amazon in 2016, a spokesman said. The breach described by Capital One didn’t require insider knowledge, he said.

‘Wa Wa Wa’

Much of what could be learned about her Monday was information she had posted online. On her GitHub Account, she was writing code dealing with The Onion Router, or Tor, an anonymity tool that allows users to conceal their identities. Capital One investigators determined that Thompson used it in her hack of the bank, according to federal prosecutors.

In online interactions, Thompson suggested she was careful to hide her digital tracks with various security tools, including Tor. But the federal complaint against her outlines relatively simple ways Capital One and the FBI were able to establish her identity, including the name on her GitHub Page.

Thompson was active in the hacking community on Twitter, and she wrote recently about struggling emotionally, and about euthanizing her beloved cat.

On June 27, “erratic” posted about several companies, including Capital One, in an online group, according to court records.

“don’t go to jail plz,” another user wrote.

“Wa wa wa wa, wa wa wa wa wa wa wawaaaaaaaaaaaa,” Thompson responded, and later added, “I just don’t want it around though. I gotta find somewhere to store it.”

On July 29, Federal Bureau of Investigation agents executed a warrant to search Thompson’s residence. In one bedroom, they found digital devices with files that referenced Capital One and its cloud computing company. The devices also included the alias “erratic.”

(Updates with New York attorney general investigation in eighth paragraph.)

–With assistance from Matt Day and Michael Riley.

To contact the reporters on this story: Christian Berthelsen in New York at [email protected];William Turton in New York at [email protected];Jenny Surane in New York at [email protected]

To contact the editors responsible for this story: Andrew Martin at [email protected], Peter Elstrom

For more articles like this, please visit us at bloomberg.com

emorales2020-02-22T19:31:30-05:00July 30th, 2019|Cyber News|

Stop robocalls to your phone for good

Help is on the way to keep your phone from constantly ringing, but there are steps you can take right now.

JASON CIPRIANI /
JULY 29, 2019 3:00 AM PDT

hiya-ios — Kill robocalls dead in their tracks.
Jason Cipriani/CNET

The number of robocalls ringing our phones at all hours of the day has reached an all-time high, and because of that those calls are also getting a lot of attention from the government and technology companies. Most recently, the House passed a bill that will all but stop robocalls. The FCC passed a proposal that gives carriers the permission to be more aggressive when blocking spam calls. Apple even added a feature to iOS 13 that lets you block all unknown callers from ever ringing your phone.

Robocalls convey a prerecorded message to your phone that often urges you to do something. Sometimes it’s a message from a candidate running for office or a call from your bank advertising a new service. Even more worrisome are the scammy robocalls — posing, say, as the “IRS” — that intend to trick people out of their money. It’ll be some time before the FCC’s proposal is implemented so, you’re not going to see a dramatic decrease in unwanted calls overnight.

Not every automated solicitation call counts as illegal. Calls from political campaigns, debt collectors and charities are all permissible. What’s not allowed are the calls from the fake IRS agents or the companies that claim you won a free vacation to the Bahamas.

While it’s not possible to entirely end robocalls from reaching your phone, there are some steps you can take to reduce the number of calls you receive.

Best practices to keep annoying robocalls at bay

According to the FCC, there are some easy steps you can take to help reduce robocalls:

Don’t answer calls from blocked or unknown numbers.
Don’t answer calls from numbers you don’t recognize.
If someone calls you and claims to be with XYZ company, hang up and call the company yourself. Use the company’s website to find an official number.
If you do answer a call and hear a recording such as “Hello, can you hear me?” just hang up.
The same goes for a call where you’re asked to press a number before being connected to a representative.

When you answer a call and interact with the voice prompt or by pressing a number, it lets the spammer know your number is real. They can then sell your number to another company, or begin targeting your number more frequently.

iphone-x-notch-6142 — Apple promises to soon lock robocalls out of your iPhone.
Josh Miller/CNET

Arguably, Google’s Call Screen feature goes against the FCC’s advice, as not only do you answer the robocall, but there’s interaction with the caller from your phone number, which will likely lead to more calls. Even though Google’s Call Screen feature is incredibly fun and entertaining to use unless you know the phone number is legit — it’s best just to not answer.

Apple recently announced iOS 13 with a ton of new features. One of those features is the option to route calls from unknown numbers straight to voicemail. According to the feature listing on this page, Siri will allow calls from numbers found in Contacts, Mail, and Messages to go through. Anything else will go to voicemail, and assuming the caller is legit, they can leave a message.

If you find yourself receiving a lot of spam text messages, you can forward the message to the number 7726 (spells SPAM). It won’t block the number from texting you right away, but it will allow your carrier to look into where it came from and put an end to it.

Google Pixel 3 and Pixel 3 XL — Call screening is part of the Pixel 3.
Sarah Tew/CNET

Check with your provider

All four major wireless carriers offer some sort of call blocking feature to customers. Some are free, while others charge for something that should be free.

AT&T’s Call Protect app is available for iOS and Android. The free version blocks calls from “likely fraudsters” and labels telemarketing calls. You can add numbers to a block list in the app, as well. The paid version provides caller ID for unknown numbers and offers mobile security features that are unrelated to robocalls. The premium version of Call Protect costs $3.99 per month.
Verizon’s Call Filter offers spam detection, spam filter, and the option to report numbers for free. You can pay $2.99 a month (or $7.99 a month for three or more lines of service) for caller ID, spam lookup, and a personal block and spam list. Call Filter is built into most Android devices out of the box (which you’ve probably been prompted about) but is also available in the App Store for iOS users.
T-Mobile’s Scam ID is free to all customers and includes Scam Block. The ID portion of the service will alert you that an incoming call is likely spam, while Block will block the call from ever reaching your phone. You need to activate the Block feature, either through the Scam Block app or by dialing #662# from your phone. You can pay $4 for Name ID to see the names of incoming callers.
Sprint’s Premium Caller ID feature costs $3 a month and will identify all incoming callers and block robocalls. There isn’t an app to install, the feature is built into “select” phones and the Sprint network.

Check with your wireless provider to see if they offer a similar service.

Android Q beta’s best new tricks from Google I/O 2019

Use a third-party app

If your provider doesn’t offer an app or service to cut back on robocalls, or it’s just too expensive, there are plenty of third-party apps available. You want to find an app that works on your device, offers automatic call blocking and spam alerts for suspicious calls and can easily report a number if a call slips through.

Hiya is a free app I have used on Android and iOS for some time now with success. It’s the same company that powers AT&T’s Call Protect app, as well as Samsung’s built-in call block and spam protection service. Samsung Galaxy users can enable the built-in service in the Phone app under Settings > Caller ID and Spam Protection. Setup is painless, and it offers an easy way to report a number.

Nomorobo is the service that Verizon uses for its Fios users, but it also has a phone app. The service is free for VoIP users and costs $2 per month for mobile users. Additional services that offer similar capabilities include YouMail and RoboKiller.

The recently released Firewall app is only available on the iPhone, and does a fantastic job of keeping calls from your phone. In the event you need to make a call that you’d rather not use your real phone number for, the $4 a month subscription provides unlimited single-use fake phone numbers.

Another option is to sign up for a free Google Voice phone number. Instead of giving out your real number for random services, you could then use your Google Voicenumber — and once the robocalls start coming in, use the block feature. Just know that blocking calls may end up being a lot of work, as robocallers are constantly spoofing different phone numbers.

None of the above solutions are perfect, and likely won’t be until carriers integrate the technology required check for caller ID spoofing, so right now you have to do some extra work to keep the number of robocalls you receive to a minimum. Between being proactive with unknown calls to your number, and using a service (paid or free), you can reduce the number of unwanted calls and spam you receive on your phone.

emorales2020-02-22T19:31:30-05:00July 29th, 2019|Cyber News|

Microsoft Plans Windows Defender Rebrand

by Nathaniel Mott July 20, 2019 at 11:50 AM

Credit: Emilija Milijkovic / ShutterstockHere’s an interesting example of Microsoft focusing more on cross-platform services: gHacks reported yesterday that Windows Defender and most of its associated services will be rebranded to Microsoft Defender when Windows 10 20H1 is released early next year.

This appears to be a minor change that won’t affect the way Windows Defender actually works. There are some questions about the rebranding–such as whether or not it will expand to previous versions of Windows like Windows 7–, but for the most part, it seems pretty straightforward. (And considerably less baffling than Toshiba Memory’s decision to change its name to Kioxia this October.)

The prevailing theory is that Microsoft wants to change Windows Defender’s name, so it’s no longer associated solely with Windows. GHacks noted that Windows Defender ATP (short for Advanced Threat Protection) expanded to Android, iOS, macOS, and Linux in 2017 before rebranding it as Microsoft Defender ATP. So this wouldn’t be the first time Microsoft nixed Windows from a cross-platform service’s name.

This would make sense with Microsoft’s new strategy of making its services available on other platforms. We noted earlier this week that this approach seems to be paying off, with Microsoft Word for Android surpassing 1 billion downloads from the Google Play Store. Windows 10 has been installed on 850 million devices; that means Word for Android is more popular than Microsoft’s latest operating system.

Focusing more on its own brand should make it easier for Microsoft to expand its services to other platforms. It’s kinda hard to see anyone installing Windows Defender on their Mac or Linux system without hesitation. Microsoft Defender would probably be an easier sell, even if it almost sounds like the company’s developing an app that leaps to its defense whenever someone bad-mouths it on social media.

emorales2020-02-22T19:31:30-05:00July 22nd, 2019|Cyber News|

Russia’s Secret Intelligence Agency Hacked: ‘Largest Data Breach In Its History’

Zak Doffman

Contributor Cybersecurity

GETTY

Red faces in Moscow this weekend, with the news that hackers have successfully targeted FSB—Russia’s Federal Security Service. The hackers managed to steal 7.5 terabytes of data from a major contractor, exposing secret FSB projects to de-anonymize Tor browsing, scrape social media, and help the state split its internet off from the rest of the world. The data was passed to mainstream media outlets for publishing.

FSB is Russia’s primary security agency with parallels with the FBI and MI5, but its remit stretches beyond domestic intelligence to include electronic surveillance overseas and significant intelligence-gathering oversight. It is the primary successor agency to the infamous KGB, reporting directly to Russia’s president.

A week ago, on July 13, a hacking group under the name 0v1ru$ that had reportedly breached SyTech, a major FSB contractor working on a range of live and exploratory internet projects, left a smiling Yoba Face on SyTech’s homepage alongside pictures purporting to showcase the breach. 0v1ru$ had passed the data itself to the larger hacking group Digital Revolution, which shared the files with various media outlets and the headlines with Twitter—taunting FSB that the agency should maybe rename one of its breached activities “Project Collander.”

TWITTER

I received a link to the Digital Revolution site where an initial tranche of breached documents was “published two months ago… as part of that 7.5 terabytes.” I won’t publish the link here for obvious reasons. Digital Revolution has targeted FSB before. It is unknown how tightly the two hacking groups are linked.

BBC Russia broke the news that 0v1ru$ had breached SyTech’s servers and shared details of contentious cyber projects, projects that included social media scraping (including Facebook and LinkedIn), targeted collection and the “de-anonymization of users of the Tor browser.” The BBC described the breach as possibly “the largest data leak in the history of Russian intelligence services.”

As well as defacing SyTech’s homepage with the Yoba Face, 0v1ru$ also detailed the project names exposed: “Arion”, “Relation”, “Hryvnia,” alongside the names of the SyTech project managers. The BBC report claims that no actual state secrets were exposed.

TWITTER

The projects themselves appear to be a mix of social media scraping (Nautilus), targeted collection against internet users seeking to anonymize their activities (Nautilus-S), data collection targeting Russian enterprises (Mentor), and projects that seem to relate to Russia’s ongoing initiative to build an option to separate the internal internet from the world wide web (Hope and Tax-3). The BBC claims that SyTech’s projects were mostly contracted with Military Unit 71330, part of FSB’s 16th Directorate which handles signals intelligence, the same group accused of emailing spyware to Ukranian intelligence officers in 2015.

Nautilus-S, the Tor de-anonymization project, was actually launched in 2012 under the remit of Russia’s Kvant Research Institute, which comes under FSB’s remit. Russia has been looking for ways to compromise nodes within Tor’s structure to either prevent off-grid communications or intercept those communications. None of which is new news. It is believed that some progress has been made under this project. Digital Revolution claims to have hacked the Kvant Research Institute before

The preparatory activities for splitting off a “Russian internet,” follow Russian President Vladimir Putin signing into law provisions for “the stable operation of the Russian Internet (Runet) in case it is disconnected from the global infrastructure of the World Wide Web.” The law set in train plans for an alternative domain name system (DNS) for Russia in the event that it is disconnected from the World Wide Web, or, one assumes, in the event that its politicians deem disconnection to be beneficial. Internet service providers would be compelled to disconnect from any foreign servers, relying on Russia’s DNS instead.

There is nothing newsworthy in the projects exposed here, everything was known or expected. The fact of the breach itself, its scale and apparent ease is of more note. Contractors remain the weak link in the chain for intelligence agencies worldwide—to emphasize the point, just last week, a former NSA contractor was jailed in the U.S. for stealing secrets over two decades. And the fallout from Edward Snowden continues to this day.

Digital Revolution passed the information to journalists without anything being edited, removed or changed—they said. Little is known about 0v1ru$ and the group has not come forward with any comment.

Neither, unsurprisingly, has FSB.

emorales2020-02-22T19:31:30-05:00July 22nd, 2019|Cyber News|

Don’t do your boss any favors buying gift cards — it’s likely a scam

Susan Tompor

We’ve had the “one ring” phone scam, the fake IRS phone calls, the scam that tricks you into thinking that your Social Security number has been connected to some car in Texas that was involved with running drugs across the border.

And now we have the “Can you do me a favor?” scam.

Sure, you’re thinking, “Hey, I know quite a few folks who ask for favors and run that scam everyday.”

But trust us, this one has a new twist.

“Usually, it starts with an email,” said Amy Nofziger, AARP fraud expert.

The email could look like it’s from your boss, maybe your minister or pastor, maybe the principal of your school.

A 31-year-old woman who had just started a job in April didn’t think twice when she got an email from her boss asking for help in early May.

“My boss was on vacation but he said he was going to be working remote,” said the Florida woman, who asked that her name not be used because she didn’t want more emails from scammers.

Investing advice: Toast America this July 4th, but run your 401(k) globally

Holiday roads: These cities have the worst Fourth of July traffic in the US

She works at a company that sells high-end appliances and her job often involves handling different projects for her boss.

So she wasn’t taken aback when he sent an email and asked her to buy four $500 gift cards to be used as prizes for employees. And she received other emails supposedly from her boss during the process.

“He kept asking: ‘Where are we on this?'” she said.

In the end, she bought two Best Buy gift cards and two Target gift cards.

She lost $2,000 in total after she charged the gift cards on her credit card.

At some point, she started thinking something was off once the boss asked for more gift cards. And then somehow, she checked on the balances on the four cards she already had bought and discovered they were all at $0.

She had sent her “boss” the codes off the gift cards and the crooks were able to access the money. She later googled scams and discovered a warning about crooks sending fake emails pretending to be your boss.

Her advice now: “As soon as you get an email like that, call your boss. Just make sure it’s him or her.”

The requests appear to be sincere
Consumers are warned that these sorts of scams can start innocently enough.

The message in the initial email might be something like: “Jane, could you please email me back? I need a favor.”

Or “Sally, are you available at the moment? I need you to handle a project. Very busy at the moment. Can’t talk. Just send an email when you receive this. Thanks.”

And remember, the phishing email is crafted to appear legitimate, often signed by someone we know. So, sure, we want to help. The email address is even similar to your supervisor’s email, too. So many of us don’t think twice.

“We want to please people and we certainly want to please people that are in a position of authority,” Nofziger said.

‘One ring’ scam: These robocalls don’t want to talk to you, they just want you to call back, FCC says

‘Grandma’ scam twist: Scammers ask grandparents to send cash, now

Liking to please people, of course, makes you a good target for scammers.

Once we respond to the first email, we’re going to get another email.

The note could say something like: “Good to hear from you. I need to get three iTunes gift cards for my niece. It’s her birthday but I can’t do this now because I’m currently traveling. Can you get them for me from any store around you? I’ll pay back next week when I get back home.”

Or the email might state: “I need you to pick up three Home Depot gift cards for our project.”

Gail Engel, 63, got a text out of the blue from Pastor Joseph saying that a friend of his has cancer and he asked her to help him buy some gift cards as a get well gift. He was at the hospital right now.

Engel, who lives in Loveland, Colo., said she works with Father Joseph but a Pastor Joseph? The wording sounded odd.

The timing of the text worked against the scammers, too.

Engel – who is retired but heads a nonprofit for grandparents raising their grandchildren – was attending a meeting of that group at a church building. The speaker was from the AARP and discussing scams.

So Engel did text back saying: “No, I can’t help you but call this number and they might be able to help you.” She texted a number for the AARP fraud hotline.

Organizations are targeted
How do the scammers even know the name of your boss?

Consumer watchdogs say the fraudsters could be using some sort of organizational chart that is easily found online. Look up a school, you’re going to have easy access to finding the emails for teachers, as well as the name of the principal. The same’s true for some online church directories or online information for a company’s staff.

“Scammers are using technology and the amount of personal information we put online to exploit us,” Nofziger said.

“It’s so creative – let’s give them some credit,” she said. “It’s creative in the way they’re social engineering you.”

“It does seem to be targeting an audience that is working or is involved in a social group,” Nofziger said.

Once the gift cards are bought, the impersonators will ask you to take photos of the numbers on the back of the gift cards and text them the photos.

Often, the person in authority says the photo is needed as a record so you can be reimbursed. But once you send those photos, you’re never, ever going to get your money back.

Crooks are able to use the numbers to download the value quickly and you’re stuck holding the bag. The money is gone and almost impossible to trace.

The scammers in the case with the four $500 gift cards somehow seemed to know that the young woman’s boss was on vacation or maybe that she was even new on the job. In retrospect, the woman said she realizes that if her company wanted her to spend that kind of money, they probably would have given her a credit card to do so.

“It was just too weird,” said the young woman, who has a toddler and a baby on the way.

She joked that she told her husband that she knew he’d be upset about her being scammed but says she reminded him that she was pregnant, so don’t get too upset.

The couple worked it out and her husband helped her deal with the added expense.

Consumer watchdogs say some gift cards requested in scams include: Home Depot, Best Buy, Amazon, Google Play, iTunes, Steam, MoneyPak and, oddly enough, even Sephora, a retailer specializing in cosmetics, skincare and fragrances.

Some consumers lose $500 and some lose as much as $5,000.

The Federal Trade Commission has warned that more scammers are demanding payment on gift cards than ever before.

Scam still going: Trending Social Security scam is costing victims thousands of dollars

Social Security scam: New phone scam attempts to make you you out to be a criminal

The AARP Fraud Network said it is seeing an uptick of phishing emails supposedly from your boss, your minister, the principal of your school, all asking for a favor.

No, the scam isn’t as widespread as one where someone pretends to be your grandson or son who is in desperate need of help. (Maybe they just got into an auto accident and they’re requesting Home Depot gift cards. Why Home Depot? The police officer needs to go out and buy tools to fix the light pole that was knocked over in the accident.)

And no, the do-me-a-favor scam isn’t as constant as the latest Social Security scam where someone needs to confirm your Social Security number so you can clear your name and prove you weren’t laundering money or hauling drugs.

But Nofziger said the scam is growing and consumers need to be made more aware of it before it hits an epidemic level. Consumers can report scams or get more information at www.aarp.org/FraudWatchNetwork or call the AARP Fraud Watch Network helpline at 877-908-3360.

So do yourself a big favor, don’t immediately respond to emails asking for a favor. Maybe pick up the phone first, call the person and ask if they really need any extra help.

Contact Susan Tompor: 313-222-8876 or [email protected]. Follow her on Twitter @tompor.

This article originally appeared on Detroit Free Press: Don’t do your boss any favors buying gift cards — it’s likely a scam

emorales2020-02-22T19:31:30-05:00July 2nd, 2019|Cyber News|

Microsoft dismisses new Windows RDP ‘bug’ as a feature

06 JUN 2019

by Danny Bradbury

Researchers have found an unexpected behavior in a Windows feature designed to protect remote sessions that could allow attackers to take control of them.

The issue, discovered by Joe Tammariello at the CERT Coordination Center (CERT) at Carnegie Mellon’s Software Engineering Institute, is documented as CVE-2019-9510. It stems from Network Level Authentication (NLA), which is a feature that you can use to protect Windows installations that have the Remote Desktop Protocol (RDP) enabled. NLA stops anyone from remotely logging into the Windows computer by requiring them to authenticate first.

Starting with Windows 10 release 1903 in April 2019, and with Windows Server 2019, Microsoft changed the way NLA works. Now, the authentication mechanism caches the client’s login credentials on the RDP host so that it can quickly log the client in again if it loses connectivity. The change enables an attacker to circumvent a Windows lock screen, warns CERT/CC, which disclosed the issue, in an advisory.

Let’s say you remotely log in to a Windows box using RDP. Then, you lock that remote desktop to stop an attacker from accessing it from your machine while you leave the room.

The attacker could interrupt the network connection between the local machine and the remote Windows box and then reestablish it, by unplugging the network cable and plugging it in again (or disabling and re-enabling Wi-Fi).

That’s where the unexpected behavior kicks in, according to the advisory:

Because of this vulnerability, the reconnected RDP session is restored to a logged-in desktop rather than the login screen. This means that the remote system unlocks without requiring any credentials to be manually entered.

The behavior also bypasses multi-factor authentication (MFA) systems that integrate with the Windows login screen, explains the advisory. Duo Security admits that its MFA products are affected, adding that the issue isn’t its fault:

By forcing the use of cached credentials, Microsoft has broken functionality used by credential providers to add resilience to this workflow.

However, rival MFA firm Silverfort says that it isn’t affected because it doesn’t rely on the Windows lock screen:

Due to the way our products [sic] operates, we are not affected by this vulnerability. We use a unique technology which allows us to enforce MFA on top of the authentication protocol itself (e.g. Kerberos, NTLM, LDAP) without relying on Windows login screen.

Microsoft also responded to the issue, explaining that it’s a feature, not a bug. It told CERT:

After investigating this scenario, we have determined that this behavior does not meet the Microsoft Security Servicing Criteria for Windows. What you are observing is Windows Server 2019 honoring Network Level Authentication (NLA). Network Level Authentication requires user creds to allow connection to proceed in the earliest phase of connection. Those same creds are used logging the user into a session (or reconnecting). As long as it is connected, the client will cache the credentials used for connecting and reuse them when it needs to auto-reconnect (so it can bypass NLA).

Unconvinced, Tammariello’s colleague Will Dormann still thinks you should work around it:

Given that Microsoft isn’t fixing this any time soon, you should use the local machine’s lock screen rather than relying on the remote box’s lock, says the CERT advisory. You can also disconnect RDP sessions when you go and visit the loo. Yes, it’s annoying, we know.

Responding to a user complaint, a Microsoft Technet moderator also said it was possible to disable automatic reconnection on the RDP host via group policy, and provided instructions.

If the phrase ‘Network Level Authentication’ rings a bell, it’s because Microsoft has recommended this as a protection measure against exploitation of CVE-2019-07-08, nicknamed BlueKeep, the serious exploit affecting pre-Windows 8 systems, which the NSA, amongst many others, is now begging people to patch.

This issue doesn’t mean that you shouldn’t use NLA to protect your pre-Windows 10 boxes. For one thing, this unexpected behavior only exists on Windows 10 and Windows Server 2019. BlueKeep doesn’t affect these editions of the Windows OS.

emorales2020-02-22T19:31:30-05:00June 10th, 2019|Cyber News|

Jules Wang

Jun 5, 2019

It’s open season on email hackers, tracking cookies and Facebook shadow profiling as our favorite open-source software makers at Mozilla have released a series of updates for its Firefox web browser, Firefox Monitor service, and its Facebook Container, as well as rounding out a series of mobile password managers with a new extension called Firefox Lockwise.

Mozilla actually has a history with password managers for mobile platforms, having launched the Firefox Lockbox app for iOS last summer and for Android this March. Ironically, the desktop version of Firefox has lacked the ability to autofill account credentials that have been previously used in the browser. With the new Lockwise extension rolling out today, that feature finally comes to the desktop and the Android and iOS apps have been renamed to align with the new brand.

The company has also updated its Firefox Monitor site, which sources its information from the data breach tracking project “Have I Been Pwned” and is able to alert users if their email address has been compromised as new breaches are reported. Mozilla has installed a new dashboard that will let users to manage multiple email addresses at once.

Mozilla has also updated its Facebook Container extension, which blocks the social platform from tracker its users’ activities on the site and on external links. It is now able to stop Facebook from collecting data wherever its sharing APIs are used. That means if a news site or blog (even ours) lets you share and like a post on Facebook, the company won’t be able to pull data and attach that to your profile or, if you don’t have an account, build a shadow profile on you. You’ll know that the container is working when you see the fence icon above a Facebook button, as you see above.

The biggest change from Firefox is that it’s about to turn on new anti-tracking measures that were promised last August. Enhanced Tracking Protection mode automatically blocks cookies listed by partner organization The Disconnect List to protect user privacy and improve page load times. Users will be able to see what trackers have been blocked by clicking on the ‘i’ symbol in the address bar.

New installations will already have ETP turned on by default. Existing users can turn on ETP manually by heading to the Content Blocking section in the browser settings and clicking on the Custom box. Users should mark the Cookies checkbox and select “Third-party trackers” from the adjacent drop-down menu. Every user will eventually have ETP turned on by default in the next few months.

Android users have already been able to block trackers with the Firefox Focus browser, though nearly all of the features in that app are concentrated on privacy. Mainstreaming ETP on establishes a new baseline on that front for more users while keeping Firefox’s flexibility.

emorales2020-02-22T20:16:07-05:00June 10th, 2019|Cyber News, Cybersecurity Tips|

By Eddie Makuch on June 5, 2019

Now Playing: Watch Dogs 3 Reportedly Leaked, Features London And Multiple Characters – GS News Update

Watch Dogs 2 Follow

[Update: Without diving a great deal into specifics, Ubisoft has confirmed Watch Dogs Legion. A tweet on the official Watch Dogs account includes a brief video that might contain some teases, but more important is the accompanying message that confirms a reveal at E3. Notably, the message also reads, “God save the NPCs,” perhaps confirming some of the details below concerning the ability to assume control of any character in the game world. We should know more in just a few days’ time, as Ubisoft’s press conference is scheduled for Monday, June 10.]

It appears another one of Ubisoft’s big E3 2019 surprises has leaked before the big show. Following the accidental reveal of a roller derby game, Amazon UK posted a product page for Watch Dogs Legion, which is apparently set in London. The listing was originally spotted by and reported on by The Nerd Mag. The game’s product description states that the game will riff on current events, and in particular the potential outcome for the city should Brexit come to pass.

“Watch Dogs Legion is set in a near-future, dystopian version of London. It’s a post-Brexit world in which society, politics, and technology have changed and altered London’s fortunes,” it says.

The product description then gets a little odd and potentially suspect. It states, “London makes total sense for WD,” which is a kind of phrasing we wouldn’t expect from a major publisher. Additionally, the product description spells the word surveillance as “surveillce.”

Something might be off with the product description, but the London setting had been rumored for many months already, while Kotaku’s Jason Schreier reported today that Watch Dogs Legion is indeed the title of the game and London is its setting.

Perhaps the most interesting part of Watch Dogs Legion is who the main character is: anyone. The product description states, “Play as anyone, Every individual you meet in the open world, has a full set of animations, voice over, character traits and visuals that are generated & guided by gameplay systems.”

Kotaku reports that it’s also heard this about Watch Dogs 3, and that some parts of the game will play out different based on the civilian you choose to play. The system underpinning this is apparently very ambitious, so much so that it’s led to at least one delay.

The first Watch Dogs was set in Chicago, with Watch Dogs 2 moving to San Francisco.

Watch Dogs Legion is not the first Ubisoft game to leak before E3 this year. A roller derby game called Roller Champions is also reportedly set for a reveal next week. Ubisoft’s E3 press conference is scheduled for Monday, June 10; assuming both of these leaks are accurate, we’ll likely be hearing about them during that stream.

Watch Dogs Legion and Roller Champions could be two of Ubisoft’s three unannounced games scheduled to release between January and March 2020. Ubisoft didn’t confirm any details for what the three games are, other than all three would be full-priced releases and all be different genres (a specific phrase used was “unique experiences”).

There is no word yet as to when specifically Watch Dogs Legion will release or what platforms it’ll be on. A spokesperson for Ubisoft told GameSpot that the company does not comment on rumors.