Top 11 Security resolutions for the New Year

by LeVar Battle | Dec 29, 2015 | Industry Intel

2015 has been the worst year so far for security breaches.  Although the state of online security reminds me of that scene in Office Space where Peter says that every day you see him is the worst day of his life, there’s a few things you can do to protect yourself against getting your data and online identity stolen.  If you’re looking for a New Year’s resolution that isn’t “I’m going to buy a gym membership and only go for a week”, try this list (it goes to 11!) on for size.

1. Change your passwords, just in case – chances are the password database of some online service that you use has been stolen sometime in 2015.  While most companies don’t store the actual password, they do store a password hash (fancy term for encryption, basically) that can sometimes be used to reverse engineer your password.  That can take some time on a powerful computer, so even though the breach might have happened 6 months ago and nobody’s hacked into your account yet, that doesn’t mean you are safe.  Change your passwords regularly, just like you change the batteries in your smoke detectors.
2. Use a password manager – every security boffin will tell you not to use the same password everywhere.  The problem with that is that we all probably have at least 3 dozen online accounts.  Remembering all those passwords, especially if you change them regularly, just isn’t feasible.  That’s where password managers come in.  Just remember one master password and the password manager software stores all the rest securely for you.  It also fills in your password automatically if you use their browser extension.  Don’t use the browser auto-fill for passwords, as those are usually not stored securely.
3. Use good passwords – don’t use a password that contains any personal information about yourself, such as your birthday, your dog’s name or your favorite flavor of Ben & Jerry’s ice cream.  Using that information makes it easier to break password hashes in the process mentioned in point 1.  Good passwords should be long and random (that’s what she said!).  If you do take the advice in point 2 and use a password manager, they typically offer a secure random password generator.  If not, you can use this website: https://strongpasswordgenerator.com/
4. Secure your WiFi – when you plugged in that new wireless router you got for Festivus, you probably didn’t realize that you had to change the password on it.  If you don’t then anyone you let on your wifi (or who breaks in) can log in to your router and do whatever they like.  While the wireless security might also be on by default, it doesn’t hurt to check and make sure it is using the strongest security setting, which is the WPA2 protocol.  To log into your router you generally have to look at the info on the bottom of the device to see how to login and what the default login and password are.  Typically you’ll put the IP address of the router into your browser to get started.  If the only association you have when I mention IP is a joke about a book called The Yellow River, then find the nerdy kid who lives on your street (the one wearing glasses and a Minecraft shirt) and offer them a $25 Gamestop gift card to come secure your router for you.  Remember to notify the kid’s parents first so they don’t think you’re kidnapping him or her.
5. Change your PIN to something unpredictable – analysis of debit card PINs shows that over a quarter of them are one of 20 common combinations such as 1234 or 0000.  If your PIN is one of the 20 on this list, then go change it right now to something that isn’t on the list.  Also, saying “PIN number” is redundant since PIN stands for “Personal identification number”, so stop saying that.
6. Freeze your credit – if you get your identity stolen you’ll eventually get it sorted out.  The problem is that will take hundreds of hours of your time, and you might not have access to your bank accounts until you get it cleared up.  Have you tried living without money lately?  It’s not a lot of fun.  If you want a story scarier than the Krampus movie, read this.  You can regularly check your credit reports for new accounts that you didn’t open, but an ounce of prevention is always best.  Call up the credit agencies and freeze your credit.  That way nobody, including you, can open new lines of credit without first unfreezing using a secure procedure.  It’ll also stop you from impulse buying a new Mustang that you can’t afford.  The FTC has a handy guide here.
7. Turn on two-factor authentication – two-factor authentication is one of the typical stupid names that techies come up with when naming technology.  It should be called something self-explanatory such as “confirm my identity”.  What it means is that when you log into an online service, they text you a passcode after you’ve logged in.  You have to type in the code they text to your phone to confirm it’s really you.  This makes sure that you not only know the password but also have access to your own phone.  Two ways of identifying you – that’s what the phrase “two-factor authentication” means in plain English.   It’s unlikely that a thief will be able to steal your password and your phone at the same time, which is why this makes things more secure.  Good banks and credit unions will have this enabled by default.  Some of your online services or banks might not have it turned on by default, which is dumb of them.  If that’s the case, go into the settings and turn it on, or call them and ask them to turn it on for you.  If your bank or credit union doesn’t offer 2FA (to make the phrase two-factor authentication even more obtuse) then it’s time to switch banking institutions.
8. Enable a PIN on your phone – yes it’s annoying.  If it bothers you that much, get a phone with a fingerprint reader.  If you don’t, then whoever finds your phone after you leave it in the bar at 3am will have your entire life at their fingertips.  They can reset all your passwords because they have access to your email.  Then they can clean out your bank accounts and leave you with something worse than a hangover the next morning.
9. Don’t believe anyone who contacts you – you know that guy who comes up to you at the gas station with an empty gas can and a story about a lost wallet?  He’s a con man.  Same goes for the person who calls you pretending to be Microsoft or the email pretending to be from Paypal.  If someone initiates contact with you then chances are they aren’t who they say they are.  If someone calls saying they are from your bank, from the IT department or from Microsoft and starts asking you for credit card numbers, passwords, or to remote into your computer, then hang up on them.  The only legitimate call you’ll get from your bank is when their security department calls you in the middle of your holiday shopping spree to verify that you are the one who made those rash purchases.  In those cases they’ll tell you what transactions were made with your card and ask you to confirm it was you and not a thief who stole your credit card details.
10. Update all your software – most hackers breaking into online systems use known vulnerabilities that have already been patched.  They look for computers that haven’t been updated to the latest patches.  Run Windows Update to update your operating system and also update any other software you use regularly.  That software will generally have a menu option to check for updates under the Help or About drop-down menu.  Well-written software will check for updates automatically.  A lot of software is not well written.
11. Don’t open email attachments – especially from people you don’t know.  Even if the email looks like it is from someone you know, it could be that their email account was hacked.  If they didn’t tell you previously to expect an email with an attachment, then don’t open it.  If you get a suspicious email from a friend or family member, call them up and ask them if they really sent it and why they attached a word document that it’s really, really important that you open right now.  Most likely they’ll have no idea what email you are talking about.  For a list of other common online and email scams, check out this page.

Wouldn’t it be nice if technology could be used to make all of the above something you don’t have to think about?  Maybe in about 20 years this will be the case.  In the meantime, it makes sense to spend a few hours protecting yourself now so that you don’t have to spend 100 hours on the phone with banks and creditors sorting out the mess when your identity gets stolen.  Stay safe in 2016!

https://www.youtube.com/watch?v=KOO5S4vxi0o

Threat Recap: Week of Dec 7th

by Connor Madsen | Dec 11, 2015 | Industry Intel

Top 5 Week of Dec. 7

UAE Bank Hack

In the last week, a major financial institution in the United Arab Emirates was hacked, with customer information being ransomed for a sum of nearly $3 million USD. The bank’s refusal to pay the significant ransom lead to the hacker releasing account information of nearly 500 customers, via Twitter. Although the Twitter accounts were shut down, the hacker continued on, contacting customers and demanding they pay a ransom for their information.

Anonymous Targets UN

In response to the arrests of protesters outside the Climate Change Summit in Paris, the hacker group, Anonymous, released sensitive information for nearly 1,500 UN officials. The protest, which started off peacefully, ended with nearly 100 protesters being arrested after clashing with local police.

Malvertising on the Rise

With internet users constantly being bombarded by ads, it’s no surprise that malware authors are joining the game. Using malicious Javascript, the ads can infect computers without the need for any user input, other than navigating to the website originally. Upon arrival on the landing page, the browser is scanned to find any exploitable plugins and, if successful, the malware is downloaded to the computer.

http://www.wired.com/2015/12/hacker-lexicon-malvertising-the-hack-that-infects-computers-without-a-click/

DDoS Attack on UK College Network

Recently, a major academic computer network in the UK fell victim to a targeted DDoS attack that slowed it down significantly and made certain functions unavailable.  The attacks began on Monday and have continued throughout the week, causing severe disruption to many universities across the country. Jisc, the company that operates and provides the network services has claimed that they are working diligently to restore functionality as quickly as possible.

Microsoft Warns of Security Issues after IE EOL

Coming as no surprise to many, Microsoft has confirmed that its flagship browser, Internet Explorer, will be reaching the end of the road. After the launch of Windows 10 and Microsoft Edge, it was only a matter of time before the highly exploited browser had the plug pulled on it. The offical end date for support on older versions will be January 12, 2016, though IE 11 will continue to receive security updates on currently supported Windows operating systems.

Threat Recap: Week of December 4th

by Connor Madsen | Dec 4, 2015 | Industry Intel

Greek Bank Cyber Attacks

Recently, several Greek banks were hit with a cyber attack that brought their systems to a halt for several hours. The hackers, claiming to be a group called the Armada Collective, demanded a bitcoin ransom be paid by Monday evening. The banks refused to pay, however, which caused the group to extend the deadline before unleashing another attack.

ModPOS on the Rise

As we enter the holiday season, a new point-of-sale malware is targeting major national retailers. The malware, named ModPOS, appears to be more advanced than previous POS infections, by using multiple different components to gather as much data as possible and encryption to hide it’s tracks. Fortunately for consumers, many retailers already use point-to-point encryption for payments, with many more expected to follow in the coming months.

Read More: http://www.latimes.com/business/la-fi-modpos-malware-20151125-story.html

Office of Personnel Management Hacked

In the past several months, it has become clear that Chinese hackers gained access to the U.S. Office of Personnel Management and exposed the data of over 20 million federal employees and their families. The Chinese government has stated that they captured the hackers responsible for the attacks, though these reports are still unconfirmed.

Read More: https://www.washingtonpost.com/world/national-security/chinese-government-has-arrested-hackers-suspected-of-breaching-opm-database/2015/12/02/0295b918-990c-11e5-8917-653b65c809eb_story.html

VTech Hack

With high tech toys becoming more prevalant, the risks of children becoming victims of cyber attacks increases as well. The latest breach comes from Hong Kong based toy company, VTech, whose servers were attacked and lead to the exposure of nearly 5 million customers’ data. The hacker, who has remained anonymous, was able to access nearly 200GB of pictures, chat logs between parents and children, and usernames/passwords for those accounts.

Read More: http://arstechnica.com/security/2015/11/hacked-toymaker-leaked-gigabytes-worth-of-kids-headshots-and-chat-logs/

Security in the Health Industry

For quite a while now, most healthcare facilities have lacked the infrastructure for increasing their data security, and simply allowing employees access to most data with a username/password. This has recently changed, and now many hospitals across the U.S. are adding two-factor authentication to their security protocols. This boost in security, along with additional training for employees will decrease the chances of a data breach in the future.