SOS Blog

This is a special notice from CERT that we have just been made aware of: Ransomware is back but under the guise of a false warning from the Department of Homeland Security.   For a review of what Ransomware is and how it works, you might want to read our past post on this malware.

So how does this new Ransomware work?

Users who are being targeted by the ransomware receive a message claiming that use of their computer has been suspended and that the user must pay a fine to unblock it. One iteration of this malware also takes a webcam (if available) photo or video of a recipient and posts it in a pop-up to add to the appearance of legitimacy. The ransomware falsely claims to be from the U.S. Department of Homeland Security and the National Cyber Security Division. – CERT

Reports of this particular nastiness are said to be occurring in the wild which means that this is  a malware that has been reported by at least two verifiable occurrences along with a sample submitted by Wildlist reporters (those with expertise in the field).

Advice:

• Don’t pay the ransom
• Notify the FBI – Internet Crime Complaint Center
• If infected by this Ransomware,
  • Contact a skilled professional OR
  • Reformat your Hard Drive and then  perform a clean reinstall of your OS.
• Change ALL passwords after safely removing the malware from your system to STRONG PASSWORDS.  If its easy for you to remember, its easy for it to be hacked – socially or using hacking software.

Prevention Tips:

• Don’t click on unsolicited links in email messages.
• Make sure your email program SCANS ALL INCOMING EMAIL MESSAGES AND ATTACHMENTS
• Reduce reliance on Email Attachments.  Instead use Google Drive inside a protected intranet and maintain strong password usage.
• Maintain updated antivirus and malware software.  Scan frequently.
• Don’t pass along email chain letters. Delete them
• Log out of all instances online.
• Review this CERT document on recognizing Email Scams
• Review this CERT document on Avoiding Social Engineering and Phishing Attacks.  We’ve covered this information in past posts but its always good to go over it again.

You really don’t want this on your computer.  So be safe and obey the rules of the road on this one.

No, this isn’t about pool safety at the YMCA, this is about making sure you have a secure connection on an insecure connection, namely every time you connect to the Internet at a public wi-fi spot.

Wifi is a public network and any data transfer passing through can be intercepted, monitored or recorded by any number of interested parties with the right software and know how.  That means if you try to access your bank online or make a purchase or login to a web application while on a public wifi network your banking details, credit card numbers, passwords, and other sensitive data can be stolen.   So what can you do to protect yourself?

By now you may have heard the term VPN. What is it exactly?  Its an acronym that stands for Virtual Private Network, a secure , encrypted “tunnel”, if you will, through which all your online data can pass safely.  It works for any application that requires an Internet connection: be it a web browser, email client, or an IM client (chat).

Searching Google  will turn up a number of free VPN’s you can use, one  such is proXPN*, but take note, they don’t all provide the same level of protection.  If you want to be sure that you are getting as much protection as you can get, you might want to think about making the monthly investment.

* Switched-On-Sites does not necessarily endorse this service.  

Several tragedies of recent have provided opportunities for people to reach out and give to help those affected.  Giving online has become easier because of technology and  its also becoming the means of choice.  Unfortunately, this also affords those who have a bad purpose to take advantage of tragic circumstances with scams.  According to a recent release from National Cyber Awareness System, there are already some who are trying to take advantage of the Boston Marathon tragedy and those who are willing to contribute.   How can they do this?  By registering fake domain names and fake social media accounts.  The US-CERT had this to say:

For example, Twitter account
@_BostonMarathon was created shortly after the explosions took place.
The account stated it would donate $1 for each retweet, and was crafted
to closely resemble the legitimate Boston Marathon Twitter account
(@BostonMarathon). This account has since been suspended by Twitter;
however, the likelihood that similar social media accounts will surface
remains high.

US-CERT recommends that you look to official charities if you wish to donate money to support those affected by tragedies, especially those that have recently happened, such as the Boston Marathon bombing,  the West, Texas Fertilizer plant explosion and the Beaumont, Texas Oil Refinery fire.

Use caution when clicking links or interacting with social media accounts that claim to be representing a charity for a recent tragedy or need.   Do your homework.  Check out legitimate news agencies for verification or trusted  local organizations and churches.

UPDATE 8/10/2014:  What to do if you are infected with Facebook Malware (includes scanner download)

As of March 2013, there are 1.06 billion users and 689 million mobile users on Facebook.  Those users  visit 42 million pages and use 9 million apps.*   That’s a lot of opportunity for hackers to get your private information and hack into your stuff.  My post today is about explaining how they are doing it.  We’re going to cover a lot of ground so play close attention.  Here’s what we’ll cover : Five ways that your Facebook account can be hacked, ‘Silent Listeners’ and a recent phishing attack on Facebook of which you need to be aware.

Five ways your Facebook account can be hacked

The following are just some of the most popular ways among hackers to get into your account.  We’ll briefly consider them and, later, what you can do to protect yourself and others.

1. Keylogging – this is done through spyware programs and basically can monitor your keystrokes, grabbing whatever information it can including your password as you type.  Affects local and remote pcs.  Very easy for them to do. Until its removed, they can monitor everything that’s being typed.
2. Phishing – is about obtaining sensitive user information (passwords, credit cards, etc) through some kind of fraud, usually an email or a web page that directs you to click a link or give up some information that lands in the hands of a hacker.   In this instance, a fake facebook page is created and the user is tempted to trust it and enter information through a login prompt.  Once the information is entered it is stored in a text file.  Now the Hacker has your login credentials.  There has been a recent attack of this and Facebook has been warned.  I’ll write more about that  in a little bit.
3. Mobile phone hacking – This is similar to keylogging (discussed above) in that it uses a spyware program installed on your smart phone to capture your keystrokes.
4. Session Hijacking – this is one where the most dangerous thing you can do to invite it is be on a non secure connection (Http:  rather than Https:).  Session hacking allows the hacker to steal your browser session cookie information which allows you to authenticate (confirms your login) on a web site, in this instance Facebook.  Session cookies are usually temporary and get deleted when you close the browser. But during their time in use, a hacker can interrupt and steal the information associated with it.
5. Side-jacking – this is similar in goal to session hijacking but the means are different.  Using a packet sniffer, the Hacker seeks  to intercept unencrypted cookies from a website in this case, Facebook,  and exploit them over a unsecure wifi connection or LAN.  In this instance, both you and the Hacker have to be on the same connection.

‘Silent Listeners’

According to a recent 7 year Facebook study (yes, we’ve been on there that long!),  there are ‘silent listeners’ getting your information on Facebook.  Although users ( on the whole since 2009) have been sharing less information publicly (electing instead to share within circles of friends), they have had others listening in to the conversations, photos, and other shared posts.  Who are these other ‘silent listeners’?  They are the third party apps so popular on Facebook.  Yes, every time you agree to that invite from your friend to remember your birthday, read The Washington Times, play Farmville,  share music from Spotify, check-in with Foursquare or any other third party app, you are sharing your private information with them.  As noted by ThreatPost, a Kaspersky lab news agency, states:

That, along with user information given up by Facebook to entities of its choosing (law enforcement, etc.) and the information from private fields that is ultimately given to advertisers comprise a significant uptick in shared personal information that oftentimes, users are completely unaware they’re sharing. It’s these apps and entities that are ultimately likened to as “silent listeners” in the trio’s paper.

So you might want to think twice about using third party apps in the future or at least limit the ones you use.

Recent phishing attack on Facebook

As of two days ago, a new phishing campaign has been targeting Facebook users and Facebook pages.  It looks and feels like a Facebook page but what it does is ask you for information Facebook is not getting – a Hacker is.

The following is an image of the so-called “Facebook Verification page” which is a bogus page asking users/admins for the page URL/ name and your login credentials. **

Once you fill out the page the Hacker has your information to exploit for selling or his/her own purposes.

Advice:

Facebook Phishing Protection:

• Don’t click on links in email messages – unless you are absolutely sure of the source.  And even then, its not that hard to go to the web site out side the email to check it out.
• Don’t put personal information in an email.
• Do not enter personal information in a pop up page (opens a new window)
• Send suspect Facebook phish pages and emails to:  https://www.facebook.com/help/217910864998172

Facebook mobile phone Protection: When connecting through a mobile phone, use a VPN (Virtual Private Network).   If you can’t afford a business or paid VPN service, there are free alternatives.  These free services will NOT give you the same level of protection so don’t use them for sensitive data transmission like bank records and such.  VPN’s  also tend to slow down your browsing speed.  Bottom line: invest in a good VPN service.

Facebook Keylogging Protection:  This is a difficult issue because many businesses use them to monitor their employees.  So some anti-keylogger software does not filter all key loggers.  There are free anti-keylogger software and paid.  Best advice: comparison shop and make yourself aware of the pros and cons of each and your situation and need.

UPDATE 3/26/2013

One of our leading Cryptograghers,  Bruce Schneier, just came out with a post addressing social sharing changes to his blog.  Again, it concerns how your and my data is being tracked through social media buttons – often without our knowledge, most definitely without our consent.  As he states the problem…

The problem is that these buttons use images, scripts, and/or iframes hosted on the social media site’s own servers. This is partly for webmasters’ convenience; it makes adoption as easy as copy-and-pasting a few lines of code. But it also gives Facebook, Twitter, Google, and so on a way to track you — even if you don’t click on the button. Remember that: if you see sharing buttons on a webpage, that page is almost certainly being tracked by social media sites or a service like AddThis. Or both. (Schneier)***

His solution to this is to use an alternative sharing system called Social Share Privacy.  It’s a plugin that developers can use  on your site to help provide a layer of privacy between you and the trackers.  Its a 2-click system.  Its not perfect but if you don’t click, you don’t get tracked.  Here’s how it works…

The buttons are first disabled and a user needs to click them to enable them. So in order to e.g. like a site on facebook with these social share buttons a user needs to click two times. But in return for this extra click a user can only be tracked be this third party sites when he decides to enable the buttons. Using the settings menu a user can also permanently enable a social share button. (Social Share Privacy)

Our post deals mainly with security, but part of that includes how much information you want third-party apps to be taking and sharing with Big Data storehouses as well.  I’ll be writing a bit more about that in a future post.

But for now,  give Switched-On-Sites a call and allow me to help make your web site secure and your information private while you do business on the web.

*Figures provided by Digital Marketing Ramblings

** image src: The Hacker News

***Schneier on Security