In the US, Thanksgiving traditionally marks the start of the holiday season, and most of us will open our hearts and minds (and wallets) just a bit more than we do during the rest of the year, and we let down our guard to enjoy the holiday spirit. Sadly, criminals and other malicious agents are also in the holiday mood, and count on the distractions of the season to really suck the joy out of the holidays. Here are some things you can do to make sure your holidays aren’t marred by the cyber Grinches:
- Stop opening email attachments
This is how the dreaded Cryptolocker virus gets onto your computer. If you receive an email from someone with an attachment that you weren’t expecting, pick up the phone and call that person to confirm that the attachment is legitimate. Hey, it’s holidays. Shouldn’t you be reaching out and touching someone anyways? - Stop clicking links in emails
Just because you received an email from someone you know that has a link to the world’s funniest/scariest/cutest video does not mean you should click that link. At minimum, hover over the link to read where it’s really going to take you. Or pick up the phone and call that person to verify they sent the email in the first place, especially if the email seems to be out of character for the sender. Sensing a trend here? Wouldn’t you rather be on the phone catching up with an old friend rather than explaining to a bunch of angry relatives why you sent them a virus via email? - Beware of fake Holiday Greeting cards, donation solicitations and other holiday-related spam
Hackers will be taking advantage of the increased volume of these types of emails. Observe rules #1 and #2, and watch out for poor grammar and out-of-character emails. Just received an X-mas ecard from someone you haven’t talked to recently? You guessed it…pick up the phone! - Be careful with your personal data
Let’s say you knuckled under the pressure and clicked a link. The website you landed on is asking you for some personal information that seems relatively harmless: Birthdate, ZIP Code, last four of your Social Security number. Unless you are at the website with which you already do business (and have verified its that company’s actual website and not a fake one!), stop what you are doing and back away from the computer. Even these bits of data can be used as a digital wedge to get at other data from your personal life, which can lead to theft of both your money and identity. - Put a password or pin on your phone
See last week’s article on why this is important, and how to do it. Don’t ask why, just do it. Trust me. - Be less conspicuous about using your smartphone
Thieves are targeting smartphone users, especially iPhone users, because the devices are in high demand on the blackmarket, especially overseas where the phones can be reactivated without fear of being tracked. A protective case can help disguise your phone, but if you really want to blend in better, choose one that isn’t blinged out and brightly colored. That case that really helps you stand out in a crowd also paints a big target on you for thieves. Keep it in a deep pocket or a bag/purse that zips or latches shut so it will be less likely to accidentally fall out and picked up by someone looks for a free smartphone. - Keep an eye on your laptop and/or tablet
A lot of us will be traveling during this time of year, and it’s becoming increasingly common to drag along our work laptop so we don’t get too far behind while visiting with family. You’d be surprised at the number of laptops lost/stolen in airports and rental car terminals, primarily because the owners are distracted and overburdened. Having to call your boss to tell them you lost your work laptop and all the data on it will make for a very stressful holiday. It’ll be even worse if you have to call clients to tell them you have lost their sensitive data or may have exposed them to a security risk. - Where possible, don’t let online vendors store your credit card information
Up until very recently, most online stores assumed you wanted to keep your credit card “on file” with them for convenience on future purchases. While this is still the case, many now offer the option to remove that information, or to not store it in the first place. Given how many websites are being hacked these days, you may be better off not keeping that number on file, especially if it’s with a store you don’t frequent. Having to enter your credit card information once or twice is a trivial inconvenience as compared to having to replace all your credit cards because a website you bought something from years ago got hacked. - Beware deals on technology “too low to be believed”
With technology, you get what you pay for 99% of the time, which is to say that if you got it cheap, it’s likely that it is cheap. That knock-off iPhone charger might have been a steal, but if it burns up your battery due to an electrical short, your $5 charger just cost you $500. - Give yourself a gift this year: Back up your data
All hard drives fail eventually. Phones break, get lost or stolen. Viruses happen. If your data is important enough to save to a disk, it’s important enough to back up. There are online subscriptions that can take care of your most precious digital assets for pennies a day and are so simple to use that anyone who knows how to click a link can set up an account. You might not be able to keep the cyber Grinches at bay forever, but a good backup can take most of the sting out of worst virus infections or hardware failures.
Image courtesy of Stuart Miles / FreeDigitalPhotos.net.
As if all the NSA surveillance nonsense wasn’t enough to put everyone on edge about covert snooping, a UK blogger has published information that appears to demonstrate that his LG Smart TV was transmitting data to internet servers about his and his family’s viewing habits, as well as information about USB devices and files attached to the television. On top of this blatant invasion of privacy, there appears to be no way to opt out of this information gathering and sharing, and the information was being sent unencrypted over the internet. When questioned about this particular behavior, an LG representative unapologetically pointed to the Terms and Conditions that the blogger tacitly agreed to upon purchase of the TV, and suggested that he take up his beef with the retailer who sold him the TV in the first place, essentially insinuating it was their fault for not warning the buyer that they were purchasing a 42″ privacy invasion.
What this means for you:
If you have an internet-enabled television, it’s very possible that device is phoning home with data about your viewing habits, and it’s also likely the only (easy) way to disable this is to disconnect the TV from the internet, a feature that was probably instrumental in this particular model being purchased in the first place. Granted, there have been thousands and thousands of families who have happily volunteered this information for decades (think Nielsen ratings), but they knowingly opted in to this reporting. It’s unclear whether TV manufacturers (and the entertainment industry in general) will come clean about this practice any time before Black Friday sells thousands (millions?) more of internet-enabled TVs, and even if they do, you can bet the majority of folks will be outraged for the regulation 15 minutes, and then will probably “return to their regularly scheduled program.” If you have concerns about your shiny big-screen selling you out, pick up the phone or write an email to the manufacturer. Failing a response from them, it may be time to raise a stink at your local big box that sold you the device, because nothing kills sales like angry customers dragging big screen TVs through the return lines.
Images Courtesy of Ohmega1982 (TV) and Salvatore Vuono (eyeball) / FreeDigitalPhotos.net
The winter holidays are upon us, and with them comes the shopping, traveling and general merry-making. Law enforcement is also warning about the increasing rate of smartphone thefts as criminals take advantage of the increased distraction, armfuls of packages and winter clothing to abscond with devices they know most people carry and use these days. Though you can do a lot to lower your profile as a potential victim, its an virtual guarantee that a certain percentage of you will have your phone stolen or lost, and aside from the loss of the device itself, your data could also be exploited to your further detriment if your device isn’t properly safeguarded against possible theft. CNET has a comprehensive article detailing how you can secure your data and increase your chances of recovering your iOS, Android or Windows smartphone in case it is stolen, but if you are in a hurry (and who isn’t, these days?), I’ll provide a summary of the basics below.
What this means for you:
For all phones:
- Use a pin, password, or fingerprint to lock your phone.
- Encrypt your phone data. iPhones and Windows Phones do this by default, but it must be enabled manually on Android devices.
- Back up your critical data, whether it’s contacts, emails or photos.
For iPhone Users:
- Disable access to any features made available through the lockscreen, such as dialing and texting via Siri.
- Set up an iCloud account and enable “Find my iPhone” so that your device can be tracked in case of loss or theft.
For Android Users:
- Disable access to lock screen features.
- Setup Android Device Manager and make sure tracking and control of your device is enabled.
- If you use a microSD card, be aware that it cannot be wiped remotely like the phone’s internal memory (but it can be encrypted).
For Windows Phone Users:
- Sit back and relax, as tracking is enabled by default and the lock screen doesn’t allow access to anything.
The article is really worth reading. If you truly are pressed for time, skip to the part that is pertinent to your specific phone platform. The author provides much more detail on how each tracking system works, as well as what the systems can and can’t do. It may mean the difference between having a happy holiday or a blue Christmas if (when) you get separated from your smartphone.
Image courtesy of Stuart Miles / FreeDigitalPhotos.net
It sounds like the title of a wonderfully bad sci-fi B-movie, but it’s actually happened: the Internation Space Station is infected with a computer virus. Not only is it infected, it’s infected with a famous virus, Stuxnet, which was used to cripple (allegedly) Iran’s nuclear weapons program. Originally designed specifically for infecting Iranian nuclear power plant systems, Stuxnet has since “gone rogue” and is now doing its dirty work around the globe. The virus was designed to be spread not only via network connections, but through flash drives and disk drives as well, primarily because many nuclear power plant control systems are too old to be connected to the internet, which is a scary thought on its own. In the case of the ISS, Stuxnet stowed away on a USB thumb drive brought on board by an astronaut.
What this means for you:
As the story above illustrates, humans continue to be the weakest link in the chain of security. You can spend tons of money on securing your technology, but it can all be blown away by a $10 thumb drive and 30 seconds of careless behavior. A big part of security is training your people not only on what NOT to do, but also on how to be vigilant and careful. As a society, we are starting to understand just how pervasive malware has become, but there are still a surprising number of people who continue to be caught off guard and impacted negatively. Given how this paradoxical, and very human behavior isn’t limited to just technology risks (think about drugs, alcohol, tobacco, base jumping, junk food, etc.) it’s no wonder malware has continued to thrive despite its destructive nature.
It’s nice that Microsoft can keep guys like me busy. Luckily, exploitation of their latest zero-day weakness seems to be limited (so far) to an advanced persistent threat (APT) attack targeting users of a specific national and international security policy website. This particular exploit is being delivered in a traditional “drive-by” attack when users of the English-version of Internet Explorer (specifically IE 7 and 8 on Windows XP, and IE 8 on Windows 7) visit this website. What distinguishes it from past threats is this malware’s ability to write malicious code directly to memory and then execute without writing to disk, a technique that makes detection and remediation much more difficult.
Microsoft intends to release a patch for this vulnerability as early as tomorrow (Nov 12). This is very fast for someone like Microsoft, and may be an indication of how serious this particular vulnerability might be.
What this means for you:
Though the exploit seems to be narrowly targeted at the moment, security researches say it wouldn’t be hard to manipulate the existing attack software to affect all versions of IE from 7 through 10, and any language in which IE is distributed. Assuming you have the leeway to do so, I still recommend using another browser like Chrome or Firefox, which still have a better track record when it comes to catching and patching weaknesses like the above. If you are required to use IE, make sure Windows Update is functional, and that you apply all critical and important updates as they are downloaded to your computer. Larger companies may control how frequently Windows Updates are applied in their enterprise, but don’t be afraid to ask your resident IT representative if they are taking steps to keep Internet Explorer safe for your use.
Microsoft zero-days seem to be happening so frequently, I’m running out of clever bon-mots to introduce these warnings. “What now?” I hear you ask. Users of Vista (Windows machines circa 2007) or Server 2008 (still in wide use everywhere) are affected by a vulnerability in versions of Microsoft Office 2003-2010. Let’s skip the gory technical details: this exploit uses a hacked image inserted into a Word document to run code that can lead to the victim’s computer being completely compromised and subject to remote control. Microsoft has not yet announced a patch for this vulnerability, but they have released a Fixit that can be run on the targeted machines to close the security hole.
What this means for you:
Security analysts are already seeing attacks utilizing this vulnerability in the wild in Asia and the Middle East, so it’s only a matter of time before victims start cropping up here in the US. If your Windows machine is running Vista, it’s highly likely you are also running a version of MS Office affected by this vulnerability. Run the Fixit immediately and consider upgrading your OS. If you have Microsoft-based servers in your environment and they are more than a year or two old, it’s highly likely they are running Server 2008, but less likely that Office is installed on the device. Your server administrator will know best how to handle this particular issue. As always, contact the sender to verify any unexpected attachments before opening them, make sure your computer is fully patched and protected by up-to-date antimalware, and double-check that your data is backed up, preferably to an offsite and fully encrypted location.
While analyzing the data trail of the recent, highly-publicized Adobe security breach and data theft, researchers also discovered data that appears to have been stolen from a prominent online broker of limousine and towncar services. Among the some 850,000 customer records discovered were such illustrious names as Donald Trump, LeBron James and Tom Hanks as well numerous other wealthy and/or famous individuals. The data also included credit card information, pickup times and locations and even ID numbers of private airplanes used by this company’s customers. The records also included notes on customer behaviors and activities including a number of tidbits that could prove embarrassing or even potentially incriminating. Even if the data were to somehow avoid falling into the hands of police or tabloids, it’s highly likely that cybercriminals will have already cherry-picked many of the customer records for their potential use to fuel spear-phishing attacks and other focused cyber-espionage attempts on corporate and government targets.
What this means for you:
You may have enforced rigor and discipline in your own technology, to the point where you feel fairly confident that you can avoid most attempts to compromise your technology security, but the above points out an uncomfortable reality: you cannot control what information is being gathered about you whenever you interact with the rest of the world. You have two choices here: acceptance and vigilance – be watchful and cautious, and come to grips with the fact that 100% security is impossible, or move to a bunker in the wilderness, off the grid and completely isolated from society. However distasteful and infuriating the former may feel some days, the latter is just not a practical choice (or even possible) for most people.
Knowing full well that American Express is the credit card of choice for many professionals, cyber criminals are targeting AMEX customers in a wave of convincing phishing emails. The emails appear to be from AMEX stating that fraudulent activity has been detected on the recipient’s card, and provides a link for the user to update their information. The link actually leads through a series of redirection scripts on compromised websites and eventually lands the user on a website that has the outward appearance of a legitimate AMEX website. This site’s sole purpose is to collect critical personal data such as your Account ID, Social Security Number, Mother’s Maiden Name which will shortly be used to perpetrate some actual account and identity theft.
What this means for you:
By now you should naturally be suspicious of any emails that show up in your inbox asking you to reset your credentials, especially if you did not explicitly perform a password or credential reset. Rolling over the links in the emails will show you the destination URL, and if the link isn’t one you recognize, stop right there and trash the email. Even if the URL looks legitimate, don’t use the link in the email. Go to your credit card website by manually typing in a URL that you know is good. Not sure what the URL is? Look for one printed on the back of your credit card, or failing that, just call the customer service number via phone. As a rule, credit card companies and banks will notify you via phone of suspected fraudulent activity, so emails like this should always be viewed with a healthy amount of skepticism.
For many professionals, LinkedIn plays an important role in their ability to network and market themselves to others, but the primary business tool of choice for just about everyone is still email. Realizing this, LinkedIn has created an app (currently only for iOS) that puts a lot more LinkedIn into your email. The app, dubbed “Intro”, is designed to provide you LinkedIn profile information (if it exists) of your recipients while you are writing your email, as well as automatically inserting an “Intro” banner that includes your profile information into every email you send. It’s this latter function that has security analysts up in arms, because in order for Intro to do its thing, it requires the user to switch their email server from the provider to LinkedIn’s own mail servers, which in turn authenticate on the user’s behalf while inserting the Intro snippet into each email as it makes its way through LinkedIn’s service. You read that right: every email you send using Intro goes through LinkedIn’s servers as well.
What this means for you:
For decades now, hackers have used a similar technology process to compromise security systems: the “Man in the Middle” attack basically tricks a computer into sending information to an alternate destination, which then forwards on the information to the intended destination, all the while pretending to be the original sender, with neither endpoint being the wiser. In this manner, the “man” in question is able to collect any information passing between the two points, including passwords and other sensitive information. Obviously, LinkedIn’s Intro app is purposefully inserted into the middle of a user’s email by the user himself, but the principle remains the same, and, at minimum, complicates security. Think of it as an email “love triangle.”
On top of this concern, security analysts have already figured out a way to spoof the information Intro inserts into your emails, essentially “weaponizing” Intro’s banner to carry any sort of payload the hacker would like, including links to hijacked websites. Imagine if you sent your client an email with a compromised LinkedIn Intro banner that led to them getting infected and their information destroyed by a virus. For now, I’d recommend sticking to inserting your own signatures into your email (which can include a link to your LinkedIn profile) and waiting a few months to see if LinkedIn has worked out all the security concerns in their new app.
Earlier this year, CEO Thorsten Heins of beleaguered tech company BlackBerry infamously stated, “In five years I don’t think there’ll be a reason to have a tablet anymore.” The press had a field day with this quote and the explosive growth of tablets in 2013 alone seems to be proving otherwise. As if to rub Mr. Heins’ and other tablet-doomsayer’s faces in it, October is seeing the launch of multiple new tablets, including new lineups from Microsoft, Nokia and Apple, all essentially debuting on the same day.
Apple dominated the American media on Oct 22 with the debut of “the lightest full-sized tablet” on the market, the iPad Air, weighing in at a diminutive single pound. It also updated the wildly popular iPad Mini with its high-resolution “Retina” display, bringing the 7″ tablet up to par with competing models from Google and Amazon. In an attempt to not be out-done (and sadly not quite succeeding in that effort), Nokia announced its first tablet today as well. The Lumia 2520 will run Microsoft’s Windows RT, a move that analysts questioned given the tepid consumer response to Microsoft’s tablet OS, but is not unexpected in light of the Redmond tech-giant’s recent acquisition of Nokia’s hardware business. Not wanting to be left out of the tablet party, Microsoft held its own midnight release event on Oct 21 at its retail stores around the country to celebrate the arrival of the Surface 2. Despite loud music, flashy displays and enthusiastic staff, the Surface 2 launch parties seemed to be (unsurprisingly) sparsely attended.
What this means for you:
If you’ve been holding off on buying a tablet for some reason, the market is currently overflowing with choices, and many of them are very strong on features and backed by staunch developer support and healthy ecosystems, notably the iOS and Android family of products. Though many are saying it’s too early to tell, the Windows RT and Windows 8 tablets have a stiff, uphill climb in the market, something that is keeping developers away from the OS, leaving Microsoft’s app marketplace relatively barren compared to the competition. There’s been a minor stir of interest in the Surface tablets from the arts industry, primarily because of the hardware’s robust pressure sensitivity, but unless you have a specific use case in mind, I’d steer clear of the Windows tablets for now. If you’ve been concerned about the size and weight of the 10″ tablets (very hard to use as bedtime readers or if you spend any time as a standing commuter) you can’t go wrong with a 7″ tablet from either Apple, Google or Amazon, all of which now feature high-definition screens, robust app stores and great portability.