Baiting...

You arrive at work and find a USB flash drive (“memory stick”) lying in the parking lot…

What should you do?

1. In order to determine if someone in my department lost this, I’d plug it into my computer and view contents of the files on it, which might help me find its owner.
2. I’ll hand this off to my IT support person. I won’t plug it into my computer, since I don’t know where it came from and what is on it.

The Answer: #2. “Baiting” is a common method for an attacker to gain access to a computer or a network. They use physical media and rely on the curiosity or greed of the victim. When the files on the device are opened, malware is executed and attempts to take control of the victim’s computer.

What to do: Have unclaimed found media inspected by your IT support personnel. Like unexpected emails, don’t trust media found in unexpected places.

Wireless access dilemma...

You are waiting in an airport and need to connect to a wireless network.  You see the following “Free Public WiFi” wireless network available:The airport is charging $10 an hour for wireless and this one is free!
The question: Do you connect or not?
 

The answer: Don’t do it.  “Free Public Wi-Fi” is both a hacker’s dream and security glitch, forming a rogue connection directly to someone else’s computer rather than to a hot spot.  Originally caused by a glitch, it is often used by hackers, knowing many people have the inability to resist connecting to such a network.  If you connect through one controlled by a hacker, your activities will be watched, and your connections will be hijacked.

What to do: ALWAYS know what wireless access points you are connecting to.  Establishments providing legitimate wireless access normally provide the name of their access points.  Don’t connect unless you are sure.

Continue or stop?

You are using a wireless access point at a local Starbucks. Upon connecting to your email, you see this:

The question: Continue or stop?

“Just this one time won’t hurt anything.”
“I’ve seen this before, sometimes a certificate expires, so it’s ok.”
“I really need to look at that email!”

The answer: Don’t continue, close the webpage. If you see this, an attacker may be “proxying” your connection, capturing your passwords, seeing everything you do, and hijacking your connection.

What to do: DON’T trust a secured connection if there is a problem with the website’s security certificate.

Sensitive Information Theft, A Real Life Example..

October 29, 2012 — COLUMBIA, SOUTH CAROLINA -- The South Carolina Department of Revenue announced that a cyber attack exposed tax returns, credit cards and personal information for over 3 million people.

What happened?

Hackers obtained a user name and password for one employee…

They used it to connect to the department’s network, log onto as many computers as possible and install password capturing software.

Using this one user’s account, they ultimately got a different user’s login and password that gave them access to critical databases, and then proceeded to steal the information.

This cost the South Carolina Department of Revenue millions of dollars to resolve…

How did this happen?

A link in a malicious phishing email was clicked on by a single user. This act apparently caused the installation of the password stealing malware, which is how the hackers got the user’s password. And things just got worse from there.

Remember:
· Don’t click on links in emails unless you are absolutely sure of their content
· Surf the Internet very carefully!

Physical theft of sensitive information...

One of the most common means of sensitive information theft is physical. This often happens when an employee takes sensitive information offsite on a portable computer or device without following proper precautions.

Stolen portable computers (laptops, tablets, smart phones) containing sensitive/protected information…

Stolen or lost memory sticks or portable hard drives that are unencrypted…

Even paperwork containing sensitive information that is stored in a briefcase or laptop case…

Remember that just one instance of stolen sensitive information can result in unfavorable press coverage and financial loss. California Breach Notice laws require that all those affected be personally notified and sometimes compensated in order to protect their identities.

What can we do to lower the chances of physical theft?

• Do not store your password with your portable computer
• You should secure your portable computer with a strong password, but never keep the password in the laptop/portable computer case or on a piece of paper or label attached to it.
• Encrypt your laptop and any portable media containing sensitive data
• Just one stolen laptop with sensitive information on it can result in unfavorable press coverage and require that all those affected be personally notified. Don’t store anything unencrypted on a portable device that you wouldn’t be comfortable with the general public viewing. Encrypt external hard drives, memory sticks and other storage as well.
• Secure your portable computer when unattended
• Attach a laptop with a security cable to something immovable or to a heavy piece of furniture when it is unattended. Devices are available that sound an alarm when there is unexpected motion or when the computer is moved outside a specified range around you.
• Do not leave your portable computer in your car
• Don’t leave your portable computer on the seat or even locked in the trunk. Locked cars are often the target of thieves.
• Do not store your portable computer in checked luggage. Always carry it with you.
• Keep track of your portable computer when you go through airport screening
• Portable computers are frequently stolen at airport screening areas. Hold onto your device until the person in front of you has gone through the metal detector. Watch for your device to emerge from the screening equipment.
• Keep it off the floor
• No matter where you are in public – at a conference, a coffee shop, or a registration desk – avoid putting your laptop on the floor. If you must put it down, place it between your feet or up against your leg, so that you are aware of where it is located at all times.
• Secure your laptop when in the office
• Secure your laptop by locking it in a docking station, if available, using a security cable, a locked office or a locked cabinet.
• Record identifying information and mark your equipment
• Record the make, model and serial number of the equipment and keep it in a separate location. Consider having the outside of the case labeled with your department’s contact information and logo.
• Backup your files
• Make an encrypted backup of your files before every trip. In the event that your laptop is lost or stolen, you will still have a copy of your data.

Panic clicking...

There has been a number of reports of some very well done Verizon Wireless phishing attempts. Clicking on the links causes the attempted install of a new variant of the Zeus bot, a nasty data stealer.

See if you can spot the fake one:

------------

Answer: the top one is fake. The only give away is that the fake e-mail doesn't include the partial account number, and typically indicates a large bill > $1,000 (at least large for me :). It is assumed that the large amount is supposed to cause panic clicking. 

Legitimate phone call or not?

You receive a phone call from someone claiming to be from Microsoft support. He informs you that your computer is sending them error messages, and it appears to be infected with a password-stealing virus.

He tells you how to look at the event logs on your computer, and informs you that the event logs with warning signs show that your computer is infected.

The support person then directs you to an official Microsoft website where he asks you to download and install a special remote access tool so that Microsoft support can fix your computer for you.

What should you do?
· Continue, as the support page appears legitimate.
· Hang up.

Answer: Hang up. This case of phone phishing and its many variants are real and ongoing organized crime activities.

It has been estimated that thousands of people have fallen for this scam.

The scam: the caller does not work for Microsoft, and the website is scarily real looking, but it is not. If you take the suggested actions, you give a stranger access to your computer.

On its website, Microsoft explicitly says it never places unsolicited calls for tech support, security updates, software validation, or the so-called “Microsoft Lottery.” More information on Microsoft-related scams can be found here:
http://www.microsoft.com/security/online-privacy/msname.aspx

What to do: If you truly believe that someone cold calling you may be from legitimate computer support, verify by hanging up, looking up their phone number and calling the company yourself.

Password cracking in the news...

We hear a lot these days about passwords being cracked after they are stolen from online sites.

What is stolen from those sites is usually an encrypted version of the password called a hash that looks something like this:


A87F3A337D73085C45F9416BE5787D86
When the above hash is run through password cracking software, it easily yields the password:

Passw0rd
Password hashes are also sometimes stolen when your computer becomes infected with malware.

Do you know which password, of the 2 below, is more secure against password cracking attempts?


A$w45#7!
Welcome2thuHotelCalifornia
If a bad guy stole the hashes for these two passwords and tried to brute force them, here’s how long it might take to crack them (assuming the bad guy had no hints):

A$w45#7!
Between 8 to 18 hours, faster if multiple computers were available

Welcome2thuHotelCalifornia
1.29 hundred trillion centuries

So, the correct answer is the LONG passphrase.
Fourteen characters or more is considered best.

Obviously, this example is a known song lyric, so someday it and others like it might ultimately be added as part of a cracking table. This has already happened to common phrases such as “Beam me up Scottie”. That’s why we changed one word’s spelling to add a little entropy. A better approach is to personalize your passphrase. An example: Welcome2BarbM’sHotelCalifornia
 
Other passphrase examples:

Somuch2doinsolittletimethisweek!
I really need a vacation and want to go 2 Barstow
My cat Max hates it 2 when I give him a bath

PS: These are examples only; Be sure and don’t use the exact passwords above.;)

Your friend probably didn't just get robbed in a foreign country

It happens often.  Imagine that you receive an email from a friend or colleague claiming that he or she is stranded in a foreign country and desperately needs your help to get home. The email originates from the friend's real email account and may even include the same email signature that your friend uses when emailing you. Thus, you might be inclined to believe that the email was legitimate, at least at first glance. However, the emails are a clever scheme by Internet criminals designed to trick people into sending them money.

Many different versions of these scam attempts have been seen. Names and other details differ depending on who's email account the scammers have hijacked, as do the countries where the "friend" is supposedly stranded. The amounts of money requested in the messages may also differ. But, in spite of such superficial differences, all such messages are versions of the same basic scam. Sadly, many people have become victims of this scam and lost money to these criminals.

If you get an email from a friend who needs you to send them money quickly while they are on vacation, be very suspicious. If they really are on vacation, find a different way to try to contact your friend to find out if this email really came from them.  But you can probably rest assured that your friend probably didn’t just get robbed in a foreign country. :)

Call Back Scams...

Employees continue to be targets of call back scams…

In some call back scams, the scammer calls its target person or company from a certain phone number and then hangs up before the phone is answered (before it goes to voicemail). Sometimes the scammer will text its phone number to its target person. The goal with this type of scam is to arouse curiosity, to get the target person to wonder “hmmm…who was that?” and call the number back. When the person calls the number back, sometimes it ends up being a premium service number and their phone bill is charged accordingly.

In the most recent scam attempt, an employee at work was targeted by a Capital One fraud phone scam. The caller left a voicemail requesting a call back, and this call wasn’t expected at all. These scams try to make you unnecessarily concerned about your account and its status, and return the call using the phone number given. The scammer will then try to socially engineer you into giving up your account information.

Be very careful about phone numbers that call your telephone and hang up, or leave a message that you definitely aren’t expecting. Always verify who called before returning the call. In the case of scams such as the Capital One attempt, calling the legitimate telephone number on your card or statement is always the best way to verify.

Of course, I prefer Grumpy Cat’s approach… ;)

A quick analysis of a suspicious email...

This other day, I received the email below that is a good potential “phish” example.  It was suspicious to me because I didn’t expect it, and it has the big “Activate your account” button on it, which always makes me nervous…

I hovered my mouse over the “Activate your account” button, and it showed this URL:

https://click.secure.castlighthealth.com/?qs=e44686b30557b0270415b9d9b54f0dc364469df8a750e6b8e9211d38a52bf60f7eabf3c8b5a4501c
 
Hmmm….doesn’t match calperscompare.com.  Not sure about this one.  However, I noticed that the email spells out the actual website, so I could manually enter www.calperscompare.com 

Before doing so, however, I entered www.calperscompare.com into one of my favorite URL checking sites, URLVoid.com .  It reported no reputation concerns with the website (0 out of 29 is good :).

I then manually entered www.calperscompare.com in my browser, and the site appears legit.  To be double-sure, I searched for “Calpers Compare” on the calpers.ca.gov website, and it checks out.

Hope you enjoyed this example of investigating a suspicious email as much as I did!  ;)

Password Reuse...

Password reuse—using the same password for multiple sites or services—is both rampant and dangerous.

Sites that have either leaked user passwords and/or had attempted account hacking using reused passwords include:

Linkedin Dropbox Hotmail Gmail Yahoo! Amazon
The worst part: Many users whose passwords were leaked had used the same password for all of their site accounts. This meant that one password loss at one site could have granted access to many or all of their accounts.

An Example

Suppose you use the same password on Sony’s PlayStation Network as you use when shopping with Best Buy. Now, suppose that your PlayStation username and password were among the 77 million leaked in April 2011. An attacker could, in principle, use that information to take a good guess at your password for Best Buy.

From a report by John Fontana at ZDNet:

“After months of Best Buy customers reporting compromised accounts, the company has finally confirmed hackers are attacking its online retail site using credentials stolen from other sites. It’s a worst-case scenario, where credentials stolen from one site are used to access other sites, most notably retail or banking sites where hackers can extract some value.”

Now just imagine if an employee did this same thing, using the same password as their employee user account on an outside site?

What should we do?

• As you should with your personal accounts, don’t use the same passwords for employee accounts, especially for work accounts where the password is stored by a 3rd party outside of your organization. And don’t use your employee account passwords on any personal site.
• Use a secure password management tool to manage and store all of the passwords for your accounts.
• Use 2-factor authentication. Read more about 2-factor authentication here: http://www.securingthehuman.org/newsletters/ouch/issues/OUCH-201211_en.pdf

Macro malware continues...

We continue to see an uptick in the number of phishing emails with attachments that have macros in them. Here’s an example of an interesting one:

If you have the default macro setting in office, you would see the following message if you opened the file:

By enabling content (running the macro), your system would become seriously infected.

Here’s the checklist for avoiding these dangerous files:

• Don’t immediately open attachments that you aren’t expecting. Make sure first that they are from a legitimate source.
• IF the file asks to enable macros, be sure to verify the file with the sender before doing so.
• NEVER configure Office to allow all macros to automatically run.

Stay suspicious…