The IT world was waiting on pins and needles yesterday for a high profile Microsoft Windows 10 security patch, and the US National Security Agency (NSA) has enlightened us as to why. Apparently the government agency has discovered a serious flaw in Windows 10 that could expose users to surveillance or serious data breaches.
The NSA confirmed (link) that the vulnerability affects Windows 10 and Windows Server 2016. It said that it flagged the dangerous bug because it "makes trust vulnerable." However, it wouldn't say when it found the flaw and declined to discuss it further until Microsoft released a patch.
The vulnerability was found in a Windows component called crypt32.dll, which handles "certificate and cryptographic messaging functions," according to Microsoft. An exploit in that area could affect authentication on Windows desktops and servers, sensitive data on Microsoft's Internet Explorer and Edge browsers and many third-party applications. Hackers could also use it to spoof digital signatures, making malware look like a legitimate app.
A software patch was released yesterday to critical Windows 10 clients including the US military and managers of key internet infrastructure. Microsoft has since released updates for all customers, urging them to install them "as quickly as practical." as this flaw is being noted the second most severe in Microsoft's rating system. Microsoft has confirmed it has not yet been exploited, but is still a major security issue.
Showing posts with label #hack. Show all posts
Showing posts with label #hack. Show all posts
Wednesday, January 15, 2020
Thursday, February 7, 2019
Is your business PCI compliant? Avoid fines for breaches!
Major breaches like TJMaxx
and Target have been widely publicized in the past, but breaches at smaller businesses have
received very little attention. This is mainly because information
about these smaller occurrences have been very hard to come by due to
two reasons.
First, not all states have disclosure laws requiring merchants to disclose breaches and secondly, card associations are not required to disclose individual cases.
First, not all states have disclosure laws requiring merchants to disclose breaches and secondly, card associations are not required to disclose individual cases.
According to a Wall Street Journal article, most breaches come from small businesses who are not up to date with technology or compliance laws. Here are some of the article
highlights:
- More than 80% of the credit card breaches have occurred at small businesses.
- Visa levied $3.3 million in fines for non compliance against small businesses in just one year.
- MasterCard did not disclose their fines.
- Any business that accepts credit cards must agree to be PCI complaint.
Here are some interesting facts that you should know about PCI compliance standards:
- Visa, MasterCard and the other card brands have put the responsibility of maintaining compliance status on the processor or merchant account provider. They've successfully done this with a policy of making them responsible for paying fines when breaches occur.
- While these processors are responsible for fines, they will almost always pass whatever they're fined onto the merchant.
- If merchants are ultimately responsible for the fines, it is their responsibility to maintain PCI standards and stay up to date with their technology.
IES would love to help you become compliant. Give us a call at 781-816-9437 or check us out online at iesAdvisors.com.
Thursday, August 2, 2018
"Site Not Secure" warnings - the latest Google problem for many website owners.
Starting last week, Google Chrome browsers begin flagging every
website that doesn't have "HTTPS" in their URL as "Site Not Secure".
With about 60% of all Internet traffic utilized through Google
Chrome, a change like can affect almost every website on the Internet.
This is the latest in the web’s massive shift from non-secure HTTP to the more secure, encrypted HTTPS protocol. All web servers use one of these two protocols to get web pages from the server to your browser. HTTP has problems that make it vulnerable to eavesdropping and content hijacking. HTTPS fixes most of these problems.
Avoiding this alert and enabling HTTPS is easily done by adding a trusted SSL certificate to your site. To help small business owners get up to speed, IES is offering some great pricing on this product along with our years of experience. If you host your site with us, your SSL certificate can be up and running within hours.
Contact us today for assistance.
iesAdvisors.com
781-816-9437
This is the latest in the web’s massive shift from non-secure HTTP to the more secure, encrypted HTTPS protocol. All web servers use one of these two protocols to get web pages from the server to your browser. HTTP has problems that make it vulnerable to eavesdropping and content hijacking. HTTPS fixes most of these problems.
Avoiding this alert and enabling HTTPS is easily done by adding a trusted SSL certificate to your site. To help small business owners get up to speed, IES is offering some great pricing on this product along with our years of experience. If you host your site with us, your SSL certificate can be up and running within hours.
Contact us today for assistance.
iesAdvisors.com
781-816-9437
Wednesday, May 30, 2018
FBI warning: Russians hacked hundreds of thousands of routers.
The FBI warned on Friday that Russian computer hackers had compromised hundreds of thousands of home and office routers and could collect user information or shut down network traffic.
The U.S. law enforcement agency urged the owners of many brands of routers to turn them off and on again and download updates from the manufacturer to protect themselves.
Infections were detected in more than 50 countries, though the primary target for further actions was probably Ukraine, the site of many recent infections and a longtime cyberwarfare battleground.
In obtaining the court order, the Justice Department said the hackers involved were in a group called Sofacy that answered to the Russian government.
Sofacy, also known as APT28 and Fancy Bear, has been blamed for many of the most dramatic Russian hacks, including that of the Democratic National Committee during the 2016 U.S. presidential campaign.
Earlier, Cisco Systems Inc said the hacking campaign targeted devices from Belkin International’s Linksys, MikroTik, Netgear Inc, TP-Link and QNAP.
An FBI official told Reuters that the kinds of devices known to be affected by the hack were purchased by users at electronic stores or online.
However, the FBI was not ruling out the possibility that routers provided to customers by internet service companies could also be affected, the official added.
If you own one of the above brand of routers you MUST restart it. To restart it, unplug your router for 30 seconds and then plug it back in.
We have no indication currently that routers from Verizon, Comcast or Cox have this vulnerability, but it wouldn't hurt to restart them anyway.
The U.S. law enforcement agency urged the owners of many brands of routers to turn them off and on again and download updates from the manufacturer to protect themselves.
Infections were detected in more than 50 countries, though the primary target for further actions was probably Ukraine, the site of many recent infections and a longtime cyberwarfare battleground.
In obtaining the court order, the Justice Department said the hackers involved were in a group called Sofacy that answered to the Russian government.
Sofacy, also known as APT28 and Fancy Bear, has been blamed for many of the most dramatic Russian hacks, including that of the Democratic National Committee during the 2016 U.S. presidential campaign.
Earlier, Cisco Systems Inc said the hacking campaign targeted devices from Belkin International’s Linksys, MikroTik, Netgear Inc, TP-Link and QNAP.
An FBI official told Reuters that the kinds of devices known to be affected by the hack were purchased by users at electronic stores or online.
However, the FBI was not ruling out the possibility that routers provided to customers by internet service companies could also be affected, the official added.
If you own one of the above brand of routers you MUST restart it. To restart it, unplug your router for 30 seconds and then plug it back in.
We have no indication currently that routers from Verizon, Comcast or Cox have this vulnerability, but it wouldn't hurt to restart them anyway.
Thursday, April 5, 2018
PSA: That Facebook quiz may be hackers mining your personal information.
Social media quizzes – especially popular on Facebook – seem innocent
enough. But taking the quiz might mean you are giving away more about
yourself than you originally thought, and may extend to your friends as
well.
These quizzes ask seemingly silly or useless questions, but hackers can use that information to penetrate your social accounts and gain access to your personal information or the information of your friends and family.
Some quizzes are designed to steal your data in an outright scam. Once answered, hackers can easily hijack personal accounts and use them to lure in more victims. The hackers will include links embedded in the quiz that can cause a security breach of your personal accounts.
But the latest news shows that it isn’t just scammers who are interested in your quiz answers. It turns out, your personal information is big business.
Not all social media quizzes are about unprincipled data collection, but the Better Business Bureau cautions users to be careful about what they share online. Profile data, quiz answers, and more can be used to used to steal your money, or let a scammer pretend to be you in order to steal someone else’s money.
These quizzes ask seemingly silly or useless questions, but hackers can use that information to penetrate your social accounts and gain access to your personal information or the information of your friends and family.
Some quizzes are designed to steal your data in an outright scam. Once answered, hackers can easily hijack personal accounts and use them to lure in more victims. The hackers will include links embedded in the quiz that can cause a security breach of your personal accounts.
But the latest news shows that it isn’t just scammers who are interested in your quiz answers. It turns out, your personal information is big business.
Not all social media quizzes are about unprincipled data collection, but the Better Business Bureau cautions users to be careful about what they share online. Profile data, quiz answers, and more can be used to used to steal your money, or let a scammer pretend to be you in order to steal someone else’s money.
Monday, October 16, 2017
Security Notice: Key Reinstallation Attack
Background
On October 16, a WPA2 exploit was disclosed known as Key Reinstallation Attack (KRACK) that affects all WPA2 protected WiFi networks. This exploit could lead to user's WiFi traffic becoming compromised.Impact
- This exploit affects any wireless product using WPA2 encryption, which includes all IES access point products.
- Those using 802.11r or mesh repeaters are most susceptible.
- Client devices that have not received a security update specifically addressing this issue are also susceptible.
- The exploit requires physical proximity to the network.
Fix
- A new firmware version is currently under test, and we expect to qualify and publish the new version of 6.3 by end of day Tuesday, October 17. An update to 6.4 will be available at that time or shortly after.
- Once new firmware is available, all networks will begin upgrading during their scheduled maintenance window automatically
- We will also be patching older versions of our WiFi software, including 481, 590, 6.1 & 6.2, with availability end of this week.
Mitigation
- In the meantime, we have turned off 802.11r on all IES WiFi devices until they have received the firmware update
- End users should contact their WiFi client device manufacturers for security updates related to their specific client devices.
Questions / Feedback
If you have any questions or concerns about this vulnerability or the upgrade process, please reach out to IES support.Sunday, September 10, 2017
Welcome to 2017 where hacking is what seems like an everyday occurrence. Cough, cough - Equifax.
Target, CNN, HBO, Chipotle, Gamestop, Equifax - what do all these companies have in common? They have all been hacked this year.
But why, in our opinion, is the Equifax hack the worst? Well, many know Equifax as one of the top three credit reporting agencies. Ever applies for a home loan or an auto loan? Chances are the bank you are using has run your credit through Equifax. Equifax is reporting that sensitive information, such as Social Security numbers and addresses, of up to 143 million Americans has been exposed. The data breach is among the worst ever because of the amount of people affected and the sensitive type of information exposed.
Unlike other data breaches, those affected by the breach may not even know they're customers of the company, as the company gets its data from credit card companies, banks, retailers and lenders - sometimes without you knowing.
When did this happen?
Equifax said the breach happened between mid-May and July. It discovered the hack on July 29. It informed the public on September 7.
How did this happen?
Equifax said criminals "exploited a U.S. website application vulnerability to gain access to certain files."
Am I at risk, and what is Equifax doing to help?
Equifax is proposing that customers sign up for credit file monitoring and identity theft protection. It is giving free service for one year through its TrustedID Premier business, regardless of whether you've been impacted by the hack.
To enroll and / or check whether you were affected, visit www.equifaxsecurity2017.com and click on the Check Potential Impact tab. You'll need to provide your last name and the last six digits of your social security number. Once submitted, you will receive a message indicating whether you've been affected. (Giving your personal information to a company that was just hacked...ironic, we know). Then, you have the option to enroll in the program, but you can't actually sign up for the service until next week. Each customer is provided an enrollment date starting earliest on Monday.
Can I sue Equifax?
If you sign up for Equifax's offer of free identity theft protection and credit file monitoring, you may be limiting your rights to sue and be forced to take disputes to arbitration. But you can opt out of that provision if you notify the company in writing within 30 days. In addition, some attorneys argue that even if you don't opt out, the arbitration provision does not cover suits related to this breach.
It seems like companies are getting hacked a lot. Is this the biggest ever?
The Equifax breach is one of the largest breaches ever. Another high-profile examples include two breaches at Yahoo - the bigger one involved 1 billion accounts, the lesser impacted 500 million.
But why, in our opinion, is the Equifax hack the worst? Well, many know Equifax as one of the top three credit reporting agencies. Ever applies for a home loan or an auto loan? Chances are the bank you are using has run your credit through Equifax. Equifax is reporting that sensitive information, such as Social Security numbers and addresses, of up to 143 million Americans has been exposed. The data breach is among the worst ever because of the amount of people affected and the sensitive type of information exposed.
Unlike other data breaches, those affected by the breach may not even know they're customers of the company, as the company gets its data from credit card companies, banks, retailers and lenders - sometimes without you knowing.
When did this happen?
Equifax said the breach happened between mid-May and July. It discovered the hack on July 29. It informed the public on September 7.
How did this happen?
Equifax said criminals "exploited a U.S. website application vulnerability to gain access to certain files."
Am I at risk, and what is Equifax doing to help?
Equifax is proposing that customers sign up for credit file monitoring and identity theft protection. It is giving free service for one year through its TrustedID Premier business, regardless of whether you've been impacted by the hack.
To enroll and / or check whether you were affected, visit www.equifaxsecurity2017.com and click on the Check Potential Impact tab. You'll need to provide your last name and the last six digits of your social security number. Once submitted, you will receive a message indicating whether you've been affected. (Giving your personal information to a company that was just hacked...ironic, we know). Then, you have the option to enroll in the program, but you can't actually sign up for the service until next week. Each customer is provided an enrollment date starting earliest on Monday.
Can I sue Equifax?
If you sign up for Equifax's offer of free identity theft protection and credit file monitoring, you may be limiting your rights to sue and be forced to take disputes to arbitration. But you can opt out of that provision if you notify the company in writing within 30 days. In addition, some attorneys argue that even if you don't opt out, the arbitration provision does not cover suits related to this breach.
It seems like companies are getting hacked a lot. Is this the biggest ever?
The Equifax breach is one of the largest breaches ever. Another high-profile examples include two breaches at Yahoo - the bigger one involved 1 billion accounts, the lesser impacted 500 million.
Wednesday, August 2, 2017
The FBI has issued a security warning about IoT toys.
IoT toys have the potential to violate children’s privacy and safety,
given the amount of pertinent information the toys can collect and
store, the Federal Bureau of Investigation (FBI) warned this week in an advisory.
The sensors, microphones, data storage capabilities, cameras and other features of Internet of Things (IoT) toys are able to vacuum up extensive details about a child’s name, school, activities and even their physical location.
And if those toys are hacked, criminals could use the stolen information to harm a child, the FBI warned.
What Makes IoT Toys Vulnerable?
Data collected from interactions or conversations between children and toys are typically sent and stored by the manufacturer or developer via a server or a cloud service. In some cases, data are also collected by third party companies that manage the voice recognition software used in the toys.
Voice recordings, toy Web application passwords, home addresses, WiFi information, and sensitive personal data could be exposed if the security of the data is not sufficiently protected with the proper use of digital certificates and encryption when it is being transmitted or stored.
Smart toys connect to the Internet either directly, through WiFi to an Internet connected wireless access point; or indirectly, via Bluetooth to an Android or iOS device that is connected to the Internet.
Key factors affecting the user’s security include: the cyber security features, the toy’s partner applications and the WiFi network through which the toy connects.
Superior communications connections - where data is encrypted between the toy, WiFi access points, and Internet servers that store data or interact with the toy - are crucial to mitigate the risk of hackers exploiting the toy or eavesdropping on conversations or audio messages.
The FBI notes that Bluetooth connected toys that do not have authentication requirements (such as PINs or passwords) pose risks for unauthorized access, enabling criminals to communicate with children.
What You Can Do To Protect Your Child
The sensors, microphones, data storage capabilities, cameras and other features of Internet of Things (IoT) toys are able to vacuum up extensive details about a child’s name, school, activities and even their physical location.
And if those toys are hacked, criminals could use the stolen information to harm a child, the FBI warned.
What Makes IoT Toys Vulnerable?
Data collected from interactions or conversations between children and toys are typically sent and stored by the manufacturer or developer via a server or a cloud service. In some cases, data are also collected by third party companies that manage the voice recognition software used in the toys.
Voice recordings, toy Web application passwords, home addresses, WiFi information, and sensitive personal data could be exposed if the security of the data is not sufficiently protected with the proper use of digital certificates and encryption when it is being transmitted or stored.
Smart toys connect to the Internet either directly, through WiFi to an Internet connected wireless access point; or indirectly, via Bluetooth to an Android or iOS device that is connected to the Internet.
Key factors affecting the user’s security include: the cyber security features, the toy’s partner applications and the WiFi network through which the toy connects.
Superior communications connections - where data is encrypted between the toy, WiFi access points, and Internet servers that store data or interact with the toy - are crucial to mitigate the risk of hackers exploiting the toy or eavesdropping on conversations or audio messages.
The FBI notes that Bluetooth connected toys that do not have authentication requirements (such as PINs or passwords) pose risks for unauthorized access, enabling criminals to communicate with children.
What You Can Do To Protect Your Child
- Choose IoT toys very carefully by doing lots of research. Look for any known reported security issues regarding a toy.
- Find out if a toy can receive firmware or software updates and security patches - and ensure the toy is running on the latest version.
- Closely monitor your child’s activities with each toy through the toy’s parent application, if such a capability exists.
- Ensure the toy is turned off when it is not in use.
- Create a strong and unique login password when establishing a user account. For extra strong passwords, use lower and upper case letters, numbers and special characters.
- Provide only what is minimally required for creating a user account.
Tuesday, January 19, 2016
The list is in! Here are the top 25 most common / dumbest passwords used in 2015.
People are still using really bad passwords to secure online accounts, despite constant advice to the contrary. As reported by Engadget, SplashData has revealed its list of the worst passwords of 2015, drawn from the 2 million passwords that leaked last year.
This year’s list is very similar to last year’s list:
As these passwords all belonged to accounts that were hacked or otherwise compromised, these are essentially the most popular bad passwords. Suffice to say anyone who wants to stay safe online should avoid using these under any and all circumstances.
Source: Engadget
This year’s list is very similar to last year’s list:
- 123456
- password
- 12345678
- qwerty
- 12345
- 123456789
- football
- 1234
- 1234567
- baseball
- welcome
- 1234567890
- abc123
- 111111
- 1qaz2wsx
- dragon
- master
- monkey
- letmein
- login
- princess
- qwertyuiop
- solo
- passw0rd
- starwars
As these passwords all belonged to accounts that were hacked or otherwise compromised, these are essentially the most popular bad passwords. Suffice to say anyone who wants to stay safe online should avoid using these under any and all circumstances.
Source: Engadget
Subscribe to:
Posts (Atom)