Will You Ace Your Cybersecurity Internship?
Cybersecurity has become the hot industry – tips and tricks on how to get the most out of your cybersecurity internship (and land a job after graduation).
Students today are faced with grueling course loads, pressure to get real-world experience and a looming competitive job market. The need for hands-on knowledge and a developed resume is crucial, making internships a necessity. However, once you nail your interview and land your position, how do you prepare and make the most out of the opportunity?
The goal of an internship is to prepare you for your future career. While earning a college degree in computer science is quite an accomplishment, in the cybersecurity field, a theoretical knowledge and your required coding and science classes just aren’t enough. It’s critical to supplement those courses with real experience tackling a variety of threats in the cyber landscape, not only to gain new skills, but also understand what it’s really like to work in cybersecurity to decide if that career path is right for you.
Learn how Webroot is building a cybersecurity talent pipeline through our annual Coding Challenge.
According to a recent Wall Street Journal article, companies and government organizations are beginning to lock in contracts with cybersecurity job candidates younger than ever before–during junior, sometimes even sophomore year. Often, these early recruits are individuals who interned for the company in the past and proved themselves as an invaluable member of the team; securing a good position and acing your internship have never been more crucial to future career success. There’s no better feeling than having job security heading back to college for your senior year or being able to focus your electives on skills that will immediately translate to skills you’ll need for your upcoming role.
Be Eager and Ready to Learn
While pursuing a major in cybersecurity provides the background necessary for your internship, you won’t know it all. You should walk into your internship everyday ready to learn the ins and outs of the field and be eager to take on new experiences. Say “yes” to everything.
According to William W. Dyer, director of the Corporate Affiliates Program for the Jacobs School of Engineering at the University of California San Diego, “Students study theories, case studies and learn both fundamental and advanced coding, but are not able to work on threats and breaches in real-time. They have structured work with a finite ending (quarters are 10 weeks long), whereas hacks and threats can happen at any time and require immediate response and solutions.”
A simple way to learn (and network) is to reach out to a few professionals who are working on a project you’re interested in or skilled in an area you’d like to further develop. Grabbing a quick coffee with someone who has been working in the cybersecurity field will allow you to gain valuable insights and real-world anecdotes. Not only will these people be able to mentor you, but they could even be a reference when the time comes for you to apply for jobs after graduation.
Be Up-To-Date on All Things Cybersecurity
Before your first day, it’s important to be well versed in the latest cybersecurity news, trends and data breaches. Taking the initiative to keep up on the latest in the industry and to provide an educated opinion on these issues will not only set you apart from other interns, but it will impress your managers and allow you to have a deeper understanding of your tasks and assignments. Every security incident is an opportunity to learn and ask questions that will serve you well later.
When pressed for what cybersecurity students should do to prepare for a future career in the space, Fred Yip, manager of software development at Webroot said, “Follow cybersecurity news and podcasts to understand what problems the industry is facing.”
Listening to a security podcast on your morning commute or setting up simple Google alerts for topics such as, ‘data breach,’ or ‘cybersecurity,’ will keep you up to date on the conversations happening in the space. Lots of great discussions happen on professional LinkedIn forums and Twitter too.
Continue to Grow in Cybersecurity, Even After Your Internship Ends
Once your internship has concluded, it is important to keep growing and honing your arsenal, especially that crucial developer knowledge. According to Dyer, “We encourage our students to participate in any and all extracurricular activities that enhance their skills.” Taking online tutorial courses or participating in hackathons or coding challenges are a great way to put your new skills to the test.
That said, continuing to challenge yourself in school and taking coding and cybersecurity classes is also important. Classes that are focused around operating systems, network security, digital forensics or a variety of computer programming languages like C++, Javascript, Python are all courses that will serve you in your future career. Finding the link between class and real-world is the key to a successful career.
Also continue following industry news and engaging with professionals through social channels. The network you create during your college years with classmates, professors and folks you meet during your internships will be instrumental in securing future opportunities. Check in with your internship managers, what’s their take on the latest data breach, acquisition or trend?
In today’s competitive job market, setting yourself apart through quality work is important and can be the key to a future at that company. While the classroom provides you with the concepts necessary to succeed, real-world experience will not only help you decide if a career in cybersecurity is something you want to continue to pursue, but you will gain invaluable knowledge and begin to grow your professional network that will be so crucial upon graduation. It is important to connect with colleagues and other interns, keep up with cybersecurity news, engage with professionals and accept as many opportunities as possible to learn about your chosen career path, allowing you to get the most out of your internship.
Cyber News Rundown: Children’s Tablets Show Vulnerabilities
Children’s Tablets Leave Users Vulnerable
At least one LeapPad tablet designed specifically for children has been found to harbor critical vulnerabilities in the app Pet Chat that could allow unauthorized access to online traffic. The vulnerabilities could be used locate the tablet’s owner by creating a temporary WiFi network to help the user connect with other devices in the area. In addition to the remote access, local attackers would be able to send messages to children through non-HTTPS communications.
UK Universities Lacking Security
A recent study found that nearly 65% of the UK’s top universities are currently operating with sub-standard cybersecurity, especially during the time that students would be sitting for final exams. Among the remaining 35% of universities that did have some domain authentication, only 5% of those were using settings that would fully block phishing emails. If UK university students are requesting any login changes, they should be cautious when opening anything they receive, as the message may be compromised.
Intel CPU Patch Issued by Microsoft
Microsoft just released a patch for an Intel CPU vulnerability that was brought to light in 2012. The flaw could have been used to breach memory data from the device. The researchers who discovered it found they could easily leak sensitive kernel memory data into the normal user operations, even though a system normally doesn’t allow this. Additionally, this vulnerability would allow for speculative execution, which is when the system begins executing certain operations pre-emptively, and simply deleting those that don’t occur.
AT&T Employees Bribed to Unlock Phones
Employees of AT&T were found to be illicitly installing hardware onto corporate systems that would allow an attacker to unlock phones that were prevented from being used on other mobile providers. Even though some of the conspirators were eventually fired, many continued to work from within and from outside the company to further compromise nearly 2 million individual devices until the scam, which had been ongoing for more than five years, was discovered.
Mobile Bank Customers’ PINs Exposed
Customers of Monzo, a mobile-only bank in the UK, are being warned to change their PINs after many customers’ were leaked into internal log files. Fortunately, the data wasn’t made available outside of the company and the problem of PINs being stored in an alternate location has been resolved. Even after the company fixed the data leak, though, many customers were still suspicious when receiving an email informing them of the PIN reset issue.
Context Matters: Turning Data into Threat Intelligence
1949, 1971, 1979, 1981, 1983 and 1991.
Yes, these are numbers. You more than likely even recognize them as years. However, without context you wouldn’t immediately recognize them as years in which Sicily’s Mount Etna experienced major eruptions.
Data matters, but only if it’s paired with enough context to create meaning.
While today’s conversations about threat intelligence tend to throw a ton of impressive numbers and fancy stats out there, if the discussion isn’t informed by context, numbers become noise. Context is how Webroot takes the wealth of information it gathers—data from more than 67 million sources including crawlers, honeypots, as well as partner and customer endpoints—and turns it into actionable, contextual threat intelligence.
What defines contextual threat intelligence?
When determining a definition of contextual threat intelligence, it can be helpful to focus on what it is not. It’s not a simple list of threats that’s refreshed periodically. A list of known phishing sites may be updated daily or weekly, but given that we know the average lifespan of an in-use phishing site to be mere hours, there’s no guarantee such lists are up to date.
“Some threat intelligence providers pursue the low-hanging fruit of threat intelligence—the cheap and easy kind,” says Webroot Sr. Product Marketing Manager Holly Spiers. “They provide a list of IP addresses that have been deemed threats, but there’s no context as to why or when they were deemed a threat. You’re not getting the full story.”
Contextual threat intelligence is that full story. It provides not only a constantly updated feed of known threats, but also historical data and relationships between data objects for a fuller picture of the history of a threat based on the “internet neighborhood” in which it’s active.
Unfortunately, historical relationships are another aspect often missing from low-hanging threat intelligence sources. Since threat actors are constantly trying to evade detection, they may use a malicious URL for a period before letting it go dormant while its reputation cools down. But because it takes more effort to start from scratch, it’s likely the actor will return to it before too long.
“Our Threat Investigator tool, a visualization demo that illustrates the relationship between data objects, is able to show how an IP address’s status can change over a period of time, says Spiers. “Within six months, it may show signs of being a threat, and then go benign.”
What are the elements of context?
Over the course of a year, millions of internet objects change state from benign to malicious and back numerous times as cyber criminals attempt to avoid detection. And because threats are often interconnected, being able to map their relationships allows us to better predict whether a benign object has the potential to turn malicious. It also helps us protect users from never-before-seen threats and even predict where future attacks may come from.
That’s where the power in prediction lies—in having contextual and historical data instead of looking at a static point in time.
Some elements that are needed to provide a deeper understanding of an interwoven landscape include:
- Real-time data from real-world sources, supplemented by active web crawlers and passive sensor networks of honeypots designed to attract threats, provide the necessary data for training machine learning models to spot threats
- An ability to analyze relationships connecting data objects allows threat intelligence providers to make a connections as to how a benign IP address, for example, may be only one step away from a malicious URL and to predict with high confidence whether the IP address will turn malicious in the future.
- Both live and historical data helps in the development of a trusted reputation score based on behavior over time and common reputational influencers such as age, popularity, and past infections.
Seeing the signal through the noise
Context is the way to turn terabytes of data into something meaningful that prompts action. Having the power to be able to dig into the relationships of internet objects provides the context that matters to technology vendors. For consumers of contextual threat intelligence, it means fewer false positives and the ability to prioritize real threats.
“Working with real-world vendors is key,” according to Spiers. “The reach of contextual threat intelligence and number of individuals it touches can grow exponentially.”
Cyber News Rundown: Ransomware Attacks on Louisiana Schools
Ransomware Targets Louisiana School Districts
At least four school districts in Louisiana fell victim to a series of ransomware attacks in recent weeks, forcing the governor to issue a state of emergency to allow federal agencies to assist local governments during these situations. The IT systems for each of these school districts were taken offline to stop the further spread of the infection. The severity of the infections varies from district to district.
Sephora’s APAC Customers Exposed
Customers from the Asia Pacific region were recently contacted by Sephora after the discovery of unauthorized access to a database containing sensitive personal information belonging to an undetermined number of users. The company has assured affected victims that no payment card information was included in the stolen data.
CapitalOne Bank Hacked
A former Amazon employee was recently arrested in connection with the breach of over 106 million CapitalOne bank customers. By using a vulnerability in the bank’s firewall the attacker was able to access not only personal data, but also bank account numbers and social security information. It also appears that, during the hack, the attacker attempted to gain the credentials for an administrator account in order to gain additional access to internal systems. Luckily for law enforcement, the attacker was brazen enough to make several social media posts regarding the breach, ultimately leading to her capture.
Honda Database Left Exposed to Public
Sensitive data for nearly 300,000 Honda employees was found in an unsecured database that was publicly available for almost a week and that was still being updated. The database was found to contain internal information on hundreds of networked computers and the employees using them. The researcher who discovered the vulnerability quickly contacted Honda, who in turn properly secured the database.
Officer Data Stolen in LAPD Data Breach
Hackers claim that they have sensitive data on 2,500 LAPD officers and over 17,000 potential applicants after a breach of the department’s network. After learning of the theft, the LAPD began contacting the affected officers and recommending they monitor their financials, though it made no mention of offering credit monitoring services.
Cyber News Rundown: Hackers Expose US Colleges
Vulnerability Exposes Dozens of U.S. Colleges
At least 62 U.S. colleges have been compromised after an authentication vulnerability was discovered by hackers, allowing them to easily access user accounts. At several of the compromised colleges, officials were tipped off after hundreds of fraudulent user accounts were created within a 24-hour period. The vulnerability that was exploited stemmed from a Banner software program that is very widely used by educational institutions; however, many colleges had already patched the flawed software versions and so were unaffected.
Data Breach Affects Lancaster University Applicants
Officials recently announced that a data breach compromised the personal records of all 2019 and 2020 applicants of Lancaster University. Additionally, some applicants have been receiving fraudulent tuition invoices, which the University recommends recipients delete immediately. The breach occurred sometime on Friday, and University officials quickly began contacting the affected parties and securing their IT systems.
Facebook to Pay $5 Billion in FTC Fines
Nearly a year after the Cambridge Analytica discovery, the FTC has issued a record fine of $5 billion to be paid by Facebook in recompense for their deceitful use of the private information from their hundreds of millions of their users. The staggering sum Facebook must pay sets a strong incentive for all industries to handle their customers’ sensitive data with the appropriate security and care, and also to address follow-up actions in the wake of a breach more adequately than Facebook did.
Remote Android Trojan Targets Specific Victims
A new remote-access Trojan, dubbed Monokle, has been spotted working through the Android™ community with a laundry list of dangerous capabilities, most of which are designed to steal information from the infected devices. To make Monokle even more dangerous, it can also install trusted certificates that grant it root level access and near total control over the device.
Fake Browser Update Distributes TrickBot
As TrickBot continues its multi-year streak of mayhem for computer systems and sensitive information, criminals created a new set of fake updates for the Google™ Chrome and Mozilla™ Firefox browsers that would push a TrickBot download. The updates appear to have originated at a phony Office365 site that does give users a legitimate link to a browser download, though it quickly prompts the user to install an update which installs the TrickBot executable.
Out from the Shadows: The Dark Web
You’ve likely heard of the dark web. This ominous sounding shadow internet rose in prominence alongside cryptocurrencies in the early 2010s, eventually becoming such an ingrained part of our cultural zeitgeist that it even received its own feature on an episode of Law & Order: SVU. But as prominent as the dark web may be, few average internet users can properly explain what it is and the cyber threats it provides a haven for. Let’s step back from the pop culture mythos and dive into what makes the dark web so dark.
Open Web, Deep Web, and Dark Web: Know the Difference
The open web, or surface web, is the internet we use every day. This includes all the web content that can be found through search engines and is accessed by traditional web browsers. Though you might find it surprising that the open web accounts for just 5% of the internet. The rest is made up of the deep web.
The deep web is the section of the internet that is not indexed by search engines and cannot be found through traditional search methods. This means that the only way to access deep web content is through a direct URL. While rumors about the deep web make it seem as if it is exclusively used for nefarious purposes, content on the deep web is often banal. It is largely comprised of school and university intranet systems, email and banking portals, internal sites for businesses and trade organizations, and even things like your Netflix or Hulu queues. Nothing to be afraid of there.
While the dark web is technically a part of the deep web, it takes anonymity a step further by using overlay networks to restrict access, often attracting users engaged in illicit activity. These networks use special anonymized software to grant users access; the largest and most famous of which is Tor. Tor stands for “The Onion Router,” which references its “onion routing” technique of using encapsulated layers of encryption to ensure privacy. Tor websites are most easily recognized by their “.onion” domains, and by the fact that they cannot be accessed through traditional web browsers. You may have heard stories about the NSA trying to shut Tor down, but don’t expect the services to go away soon. It has funding from high places, with a recent FOI request revealing that one of Tor’s largest financial contributors has long been the U.S. State Department—likely to offer encrypted communication options for State Department agents working in the field.
Is the Dark Web Illegal?
The dark web isn’t inherently illegal—the illegality comes from how it can be used. Darknet markets, such as the infamous and now defunct original Silk Road, showcase how thin the line is between legal and illegal dark market activities. As long as what you are purchasing is legal, using a darknet market is as lawful as making a purchase from any other online retailer. But buying illicit drugs or human organs? Yeah, that’s definitely illegal.
Although not as remarkable as some of the more grotesque items available, one of the most commonly found items for sale on the dark web is data. With a reported 281 data breaches in just the first quarter of 2019, we have already seen 4.53 billion records exposed this year alone. That’s potentially more than 4 billion chances for hackers to profit off the victimization of strangers, and a majority of them will use the dark web to do so. We have seen several high-profile data breaches resurface on the dark web—Equifax, Canva, Under Armor, and Evite all recently had their user data available for sale on darknet markets.
The Dark Web and Malware-as-a-Service
Beyond selling your data, the dark web can be used to harvest it as well. Webroot Security Analyst, Tyler Moffitt, explains this growing threat:
“Anyone can create malware in today’s landscape where the dark web is very accessible,” says Moffit. “There are ransomware services on .onion links that will allow you to input just a few bits of information, like a bitcoin address, desired ransom, late fees, etc., and unique binaries are generated to distribute however they like. The only ‘catch’ is that the portal creator usually takes a cut (around 30%) for any ransom payments made.”
These malware-as-a-service attacks mean that an attacker doesn’t even need to know how to execute one; they just need to know how to navigate to the portal. Therein lies the largest dark web danger for many consumers—anonymized cyberattacks available at the click of a mouse.
Keeping Your Data Off the Dark Web
Like a hydra with its multiple heads, black markets will likely never be wiped out. When you shut one down, two more will pop up. Darknet markets are just their newest evolution. While you can’t expect to see this threat disappear anytime soon, you can take steps to keep your data secure and off the dark web.
Using an up-to-date antivirus solution will help stop malware from scraping your data on the dark web. You can also lock your credit (called freezing) to help prevent new credit lines being open without additional information. Another recommendation is avoiding public WiFi without a VPN, as it leaves you susceptible to a man-in-the-middle attack (MITM). Even with these precautions, a breach may still occur. Keeping your sensitive accounts secured with a trusted password manager can also help prevent cyber attacks from spreading beyond their breach point.
Follow us on Facebook and Twitter to stay up to date on the latest threats to your online security and privacy.
Cyber News Rundown: Evite Data Breach
Over 100 Million Accounts Exposed in Evite Breach
More than 100 million users of Evite were exposed after the company’s servers were compromised earlier this year. While the company doesn’t store financial information, plenty of other personally identifiable information was found in the leaked database dump. The initial figures for the breach were thought to be much lower, as another database dump of 10 million Evite users was found on an underground marketplace around the time they discovered the unauthorized access, though that site was shut down soon after.
American Express Suffers Phishing Attack
Many American Express customers recently fell victim to an email phishing attack that used the uncommon tactic of hiding the URL domain when hovering over the hyperlink. The attack itself, which requests the victim open a hyperlink to verify their personal information before re-routing them to a malicious site, was reliably full of spelling and grammar mistakes. The phishing landing page, though, looks nearly identical to the real American Express site and even has a drop-down list to catch multiple types of user accounts.
NHS Worries Over XP Machines
Over five years after Microsoft officially ceased support for Windows XP, the UK government has revealed that there are still over 2,000 XP machines still being used by its National Health Services (NHS). Even after becoming one of the largest targets of the 2017 WannaCry attacks, the NHS has been incredibly slow to roll out both patches and full operating sytem upgrades. While the number of effected systems, the NHS has over 1.4 million computers under their control and is working to get all upgraded to Windows 10.
Google Defends Monitoring of Voice Commands
Following a media leak of over 1,000 voice recordings, Google is being forced to defend their policy of having employees monitor all “OK Google” queries. After receiving the leaked recordings, a news organization in Belgium was able to positively identify several individuals, many of whom were having conversations that shouldn’t have been saved by the Google device in the first place. The company argues that they need language experts to review the queries and correct any accent or language nuances that may be missing from the automated response.
Monroe College Struck with Ransomware
All campuses of Monroe College were affected by a ransomware attack late last week that took down many of their computer systems. The attackers then demanded a ransom of $2 million, though it doesn’t appear that the college will cave to such exorbitant demands. Currently, the college’s systems are still down, but officials have been working to contact affected students and connect them with the proper assistance with finishing any coursework disrupted by the attack.
Cyber News Rundown: Major Spike in Magecart Attacks
Magecart Attacks See Spike in Automation
The latest attack in the long string of Magecart breaches has apparently affected over 900 e-commerce sites in under 24 hours. This increase over the previous attack, which affected 700 sites, suggests that its authors are working on improving the automation of these information-stealing attacks. The results of these types of attacks can be seen in the latest major fines being issued under GDPR, including one to Marriott for $123 million and another to British Airways for a whopping $230.5 million.
Agent Smith Android Malvertiser Spotted
Researchers have been tracking the resurgence of an Android-based malware campaign that disguises itself as any number of legitimate applications to deliver spam advertisements. After being installed from a third-party app store, the malware checks both a hardcoded list and the command-and-control server for available apps to swap out for malicious copies, without alerting the device owner. The majority of targeted devices have been located in southwestern Asia, with other attacks showing up in both Europe and North America.
Third Florida City Faces Ransomware Attack
Almost exactly one month after the ransomware attack on Lake City, Florida, a third Florida city is being faced a hefty Bitcoin ransom to restore their systems after discovering a variant of the Ryuk ransomware. Similar to the prior two attacks, this one began with an employee opening a malicious link from an email, allowing the malware to spread through connected systems. It is still unclear if the city will follow the others and pay the ransom.
British Airways Receives Record GDPR Fine
Following a data breach last year that affected over 500,000 customers, British Airways has been hit with a total fine amount of $230.5 million. The amount is being seen as a warning to other companies regarding the severity of not keeping customer data safe, though it’s still much less than the maximum fine amount of up to 4% of the company’s annual turnover.
Georgia Court System Narrowly Avoids Ransomware Attack
Thanks to the quick work of the IT team from Georgia’s Administrative Office of the Courts (AOC), a ransomware attack that hit their systems was swiftly isolated, leading to minimal damage. Even more fortunate for the AOC, the only server that was affected was an applications server used by some courts but which shouldn’t disrupt normal court proceedings. Just days after the initial attack, the IT teams (aided by multiple law enforcement agencies) were already in the process of returning to normal operations without paying a ransom.
Cyber News Rundown: Second Florida Ransomware Attack
Second Florida City Pays Ransom
Following the news that Riviera Beach, FL would pay the ransom demanded by cyberattackers, the mayor of Lake City, FL has announced that the city will be paying the demanded ransom of $460,000 to restore access to their email and internal system servers. While law enforcement agencies strongly recommend against paying the ransom and suggest that victims instead attempt to recover encrypted files through backups or other offline methods, many companies who fall prey to ransomware attacks do not keep complete backups of their systems, so they may have no choice but to pay.
Group Arrested in Domain Spoofing Scam
Several individuals were recently arrested for creating a spoof domain for Blockchain.com, a site that allows users to access their cryptocurrency wallets. The individuals in question successfully stole over $27 million’ worth of various currencies from roughly 4,000 victims by using their spoofed site to steal wallet credentials. The group was captured in two separate countries after more than a year of investigation.
Database for Insurance Marketing Site Exposed
A database belonging to MedicareSupplement.com, an insurance marketing site, was found to be publicly accessible, exposing the records of over 5 million customers. While it is unclear how long the database had been improperly secured, the researcher who discovered it in mid-May promptly reported it to the database owner. Amongst data exposed were nearly a quarter million records that indicated specific insurance categories.
Report Reveals Countries Most Targeted by Ransomware
A new report has run the numbers to uncover the top five countries most targeted by ransomware. So far in 2019, the list includes the USA, Brazil, India, Vietnam, and Turkey. During the first quarter of this year alone, the USA took 11% of the attacks, with Brazil coming in right behind with 10% of the total number of attacks. Even more concerning: the average ransom demand has nearly doubled since this time last year, jumping from around $6,700 to ca. $12,700.
IoT Malware Bricks Devices
Researchers have just found a new type of malware, dubbed Silex, that focuses on IoT devices running with default credentials. The malware then bricks—i.e., breaks in an irreparable or unrecoverable fashion—the entire device. The Silex authors claim to have distributed it with the specific intention of rendering devices unusable to prevent lower level scripters from adding the devices to their botnets. Fortunately, the authors did shut down the malware’s command servers, though the already-distributed samples will continue their operations until they have been removed by security.
Webroot DNS Protection: Now Leveraging the Google Cloud Platform
We are excited to announce Webroot® DNS Protection now runs on Google Cloud Platform (GCP). Leveraging GCP in this way will provide Webroot customers with security, performance, and reliability.
Security
Preventing denial of service (DoS) attacks is a core benefit of Webroot DNS Protection. Now, the solution benefits from Google Cloud load balancers with built-in DoS protection and mitigation, enabling the prevention of attack traffic before it ever hits the agent core.
“The big thing about Google Cloud is that it dynamically manages denial of service (DoS) attacks,” said Webroot Sales Engineer Jonathan Barnett. “That happens automatically, and we know Google has that figured out.”
Click here to learn why businesses need DNS protection.
Performance
With this release, Webroot DNS Protection now runs on the Google Cloud’s high-redundancy, low-latency networks in 16 regions worldwide. That means there’s no need for a Webroot customer in Australia to have a DNS request resolved in Los Angeles, when more convenient infrastructure exists close by.
“Google Cloud provides the ability to scale by adding new regions or new servers whenever necessary as load or need determines, nationally or internationally,” said Barnett. “This allows us to provide geolocation-appropriate answers for our customers, maximizing performance.”
Reliability
Because of GCP’s global infrastructure footprint, Webroot can quickly and easily provision more of Google’s servers in any region to ensure latency times remain low.
And because those regional deployments can be programmed to auto-scale with spikes in traffic, even drastically increasing loads won’t increase wait times for requests.
According to Barnett, “Even if Webroot were to take on a large number of customers in a short time period, say with the closing of a deal to offer DNS solutions to an enterprise-level client with a number of subsidiaries, our environments would automatically scale with the additional load.”
One more note on the release
Another key feature of the April DNS agent update regards switching communications from port 53, which is typically associated with DNS requests, to port 443, which is more commonly associated with SSL certificates.
The reason for this change is that, given port 443’s relevance to routine requests like banking sites and those accepting payment information, it is rarely constrained, modified, or controlled. This will reduce the need to configure firewalls or make other admin adjustments in order for Webroot DNS Protection to function as intended.
It’s good to be in good company
With Webroot DNS Protection now leveraging the GCP will power your network-level protection. Fewer outages, latency, and bottlenecks. Ready to experience Webroot DNS Protection for yourself? Try it free for 30-days here.
Streaming Safer Means Streaming Legally
It’s been more than a decade since Netflix launched its on-demand online streaming service, drastically changing the way we consume media. In 2019, streaming accounts for an astonishing 58 percent of all internet traffic, with Netflix alone claiming a 15 percent share of that use. But as streaming has become more common, so has the exploitation of streaming technologies. Some consumers stream illegally to cut costs, perceiving it to be a victimless crime. But as the saying goes: there’s no such thing as a free lunch. Streaming is no exception.
Browsing on public WiFi? Learn how to protect your network connection with a VPN.
Jailbreak!
By downloading illegal streaming apps from third-party sources (i.e. outside of the Apple® App Store or Google™ Play), users may think they’re capitalizing on a clever loophole to access free services. However, according to a startling study conducted by Digital Citizens, 44 percent of households using pirated streaming services experienced a cybersecurity breach of one or more of their devices. That means if you use any type of illegal streaming device or app, you are six times more likely to fall victim to a cybersecurity attack than households using legal streaming services. Since a reported 12 million homes—in North America alone) are actively using pirated streams, that means illegal streaming may have led to up to 5 million potentially undetected breaches.
Why are illegal streams so attractive to cybercriminals? Because you’re probably streaming using devices and applications that are connected to your home network. Unfortunately, the firewall on the average home router does not provide adequate security against attacks. Any malware introduced by the streaming software is likely able to get through successfully. If you’re using a Window® computer or device, that means the malware can infiltrate not the device you’re actively using, but also any other Windows devices using the same internet connection. By spreading itself across multiple devices, malware makes its own removal that much more difficult. Pair these details with the fact that illegal streaming users are less likely to report a malicious app, illegal streams provide a haven for cybercriminals in which they can easily attack users, infect their machines, steal their data, and hold their files for ransom.
Cybersecurity breaches caused by illegal streaming can manifest in many ways. For example, a popular illegal movie and live sports streaming app was observed scraping the connected WiFi name and password, as well as other sensitive information, according to ThreatPost.
How You Can Stream Safer
Ultimately, nobody can guarantee the security of an illegal stream.
The truth is that legal streaming is the only safer streaming. That doesn’t
mean you have to go through the giants, like Netflix or Hulu. Users can now access
many low-cost, legal streaming options—including a few that are ad-supported and are actually free. So
why put yourself and your family at risk for the sake of an illegal stream?
If you’re worried that someone with access to your WiFi network may be
streaming illegally, thereby putting you and your devices in danger, make sure
all of your devices are using up-to-date antivirus software to help stop cyberattacks and prevent malware infections. More
importantly, talk with your family and friends about the real cost of “free”
streaming. They’ll be more cautious once they fully understand the risks.
Looking for more home security education? Check out our Home + Mobile playlist on YouTube.
Cyber News Rundown: GPS Vulnerabilities in Tesla Vehicles
Multiple Tesla Models Vulnerable to GPS Attacks
Though it’s not the only manufacturer to offer GPS navigation in their vehicles, Tesla has once again suffered an attack on their GPS autopilot features. These attacks were able to trick the car into thinking it had arrived at an off-ramp more than two miles early, causing it to start to merge and eventually turn off the road entirely, even with a driver attempting to stop the action. Using off-the-shelf products, the test conductors were able to gain control of Tesla’s GPS in less than a minute.
Oregon DHS Successfully Phished
The personally identifiable information for at least 645,000 Oregon Department of Human Services (DHS) patients was illicitly accessed after a successful phishing attack on nine DHS employees. The attack allowed the hackers to obtain 2 million emails from the accounts, which contained everything from names and birthdates to social security numbers and confidential health information. Fortunately, the DHS issued a password reset shortly after the initial breach that stopped the attackers from getting any further and began contacting potential victims of the attack.
IP and Computer Blacklisting in New Ryuk Variant
The latest variant of the Ryuk ransomware includes an IP blacklist and a computer name check prior to beginning encryption. The IPs and computer name strings were likely implemented to stop any encryption of Russian computer systems. After these checks, the ransomware continues as normal using .RYK as the appended file extension and a ransom note that points victims to make payments to one of two proton mail accounts.
EatStreet Ordering Services Breached
A data breach is affecting the food ordering service EatStreet and possibly all of its 15,000 partnered restaurants. Payment card information for millions of customers using the app, along with some banking information for the 15,000 business partners, is believed to have been compromised in the breach. Though EatStreet quickly began improving their security and implementing multi-factor authentication following the breach, the damage was already done.
Fake System Cleaners on the Rise
While phony system cleaner apps have been common for many years, a recent study shows that user numbers for these apps has doubled from the same time last year to nearly 1.5 million. These apps often appear innocent and helpful at the outset, while others have begun taking an outright malicious approach. To make matters worse, these apps are commonly installed to fix the very issues they later create by slowing the computer down and causing annoying popups.