If the hack of Yahoo corporate and compromise of hundreds of millions of account users’ data wasn’t enough of a reason to delete your Yahoo account and never look back, how about the fact that former Yahoo CEO Marissa Mayer gave a thumbs-up to the U.S. Government’s request to be able to search each and every email in her company’s database? Not that anyone worth their salt uses Yahoo for anything but an occasional news feed, or getting information from Yahoo Answers, but if you’re still naively or archaically using Yahoo to send and receive emails that have any kind of personally-identifiable or sensitive information in them at all, this post is for you.

 

The plain fact of the matter is that if you are still using Yahoo to regularly send and receive emails, you are engaging in a platform that has opted-in to NSA spying in the biggest way (literally). To illustrate how badly compromised, spied-on, and hacked-into Yahoo.com is, Alex Stamos, the new head of security at fellow spy tool Facebook resigned in protest at the blasé disregard of his former CEO for her colleagues’ input on green-lighting NSA spying throughout her company’s platform. To wit, Facebook can now look at Yahoo and say, “Wow, they are a government spy’s dream come true.”

How to Permanently Delete Your Yahoo Account

Ironically, the top-rated answer on Google for “how to delete yahoo account” lands you on a Yahoo Answers page! To close your Yahoo account permanently, go to this link: https://edit.yahoo.com/config/delete_user, where you will be asked to sign in. If it’s been a while since you’ve logged into your account (since the hacking occurred) you will be asked to change your password. After doing this, you will be taken to a page that explains the implications of deleting your account, will be prompted to re-enter your new password – plus a captcha – and then you can click on a button that says “close my account,” or something to that effect. It will then tell you that “Your account is scheduled for deletion in 90 days. This is to ensure that no illegal third-party activity occurs using it.” Yeah, like the NSA yard sale Marissa Mayer had with her users’ email account data? And, the subsequent hacking of hundreds of millions of accounts – all of which didn’t put a dent in the ex-Yahoo CEO’s nearly half a billion-dollar net worth? You mean that kind of illegal third-party activity, Yahoo? Thanks for your conscientiousness.

Cyber Safety and Security from IT Experts

If you need further help with cyber safety awareness and security, {company} is a proven leader in providing IT consulting and cybersecurity in {city}. Contact one of our expert IT staff at {phone} or send us an email at {email} today, and we can help you with all of your cyber safety, defense, and security questions or needs.

A new discovery by a Brazilian Infosec research group called Morphus Labs should (once again) make you think twice about clicking on any unsolicited links. Dubbed “Mamba,” the new ransomware strain, like the snake it was named after, strikes with a paralyzing strength, able to lock down full disks instead of just individual files. Using an open source tool called DiskCryptor, it’s able to do great damage by deeply encrypting all the data found on the target machine’s hard drive.

 

Mamba is very similar to fellow ransomware variant Petya, both of which use a disk-level encryption system, which seems to be a growing trend in the rapid spread of ransomware. “You Are Hacked,” says the message left by Mamba, along with a number victims are expected, via a unique ID, to call to find out where to pay the bitcoin worth of ransom (worth around $600) and get the private decryption key. Actually, the full message goes something like, “You are Hacked ! H.D.D Encrypted, Contact Us For Decryption Key ([email protected]) YOURID: 123152” (as seen in the image below):

This latest ransomware strain blocks the machine’s OS from even booting up and overwrites the boot disk master boot record, or MBR replacing it with a custom MBR that displays the ransom note asking for the decryption password. As soon as the malware variant is introduced on the targeted machine, it will reboot, but before the reboot, Mamba installs itself as a fake defragmentation service via Windows, which looks like the image at left.

Renato Marinho of Morphus Labs and his team have been working around the clock to counteract the insidious lock-down proposed by Mamba. He remarks, in a post on LinkedIn Pulse: “We found Mamba last September 7, during an incident response procedure for a multinational company that had some servers compromised by this malware in Brazil, USA and India subsidiaries.”

Marinho goes on to say that the decryption password may be the same for all victims of Mamba, also known as HDDCryptor, or that it may be something related to the victim’s environment, such as a hostname, or something similar. The Morphus Labs team has not yet located the infection vector, but they are still at it. We will try to update you on Marinho’s team’s progress.

 

In the meantime, as is the case with all of our messages on ransomware, we advise never paying the ransom, but instead letting an expert in malware infection lead a step-by-step analysis and countermeasures implementation to bypass and ultimately discard the ransomware from your computer. Also, don’t click on any unsolicited links, and have only the best antivirus software running on your network and all devices.

Let the Cybersecurity Experts Handle It

If you need further advice about cybersecurity and ransomware, {company} is a proven leader in providing IT consulting and cybersecurity in {city}. Contact one of our expert IT staff at {phone} or send us an email at {email} today, and we can help you with all of your cyber safety, defense, and security questions or needs.

Just last month FBI Director James Comey advised that anyone using a webcam put tape over it to block out webcam spies, comparing it to locking your door. It was already revealed in recent years that hackers using spyware can both watch you and hear and record your conversations through the webcam’s microphone, so is the FBI director going far enough in his counsel? What he should be saying is, “Tape over your webcam camera and microphone.” Or, better yet, unplug it from its USB port completely when not in use. And, if that’s too inconvenient for you because you use your webcam all the time, then get something rigged up that blocks the camera and microphone between webcam sessions, for Pete’s sake!

 

Back in June, Mark Zuckerberg was seen in a video with his own web camera taped up. In April, Comey said that he was taping up his own webcam, so why the months-long wait to make an official statement on the matter? Probably because Comey has been busy being grilled by congressman Trey Gowdy over his bumbling “investigation” into the emailing (and other) crimes and cover-ups of Hillary Clinton. One wonders if he remembered to tape up his webcam before he went to Capitol Hill under subpoena.

“You go into any government office and we all have the little camera things that sit on top of the screen. They all have a little lid that closes down on them. You do that so that people who don’t have [the] authority [to] don’t look at you. I think that’s a good thing,” said Comey in a recent statement. The most telling thing here may be that James Comey referred to webcams as “camera things”. The title of this post might just as well be, “Tape Over Those Camera Things That Sit on Your Screens,” but digress we must, due to this widespread affliction of untaped-up camera thingies.

Seriously, a little tape might not be enough to thwart determined webcam spies. As this writer does, you may want to go ahead and just unplug your webcam from its USB port and stick it in a drawer between Skype sessions and webinar meetings, for that added assurance that hackers with nothing better to do want to listen in on your private (and important business) conversations.

Free Webcam Spy-Detection Tool for Mac

Ex-NSA hacker and Mac security expert Patrick Wardle has just recently released a free tool for Mac users that monitors your computer and alerts you to when any application, such as Skype or FaceTime (or even a questionable app) is accessing your webcam and microphone in an “untoward” way. Wardle argues that a piece of tape can only get you a certain amount of security, though. He points out that spyware piggybacks on FaceTime and Skype sessions, blending in undetected.

“These are the kind of things that as an attacker you would want to record anyways, because otherwise I’m just sitting at my desk petting my dog,” Wardle said jokingly. He returned to a note of seriousness, though, saying, “I want to know who and what is using my webcam.”

Don’t we all?

Have Questions About Webcam Security?

If you need further advice about preventing webcam spies from listening-in on you, {company} is a proven leader in providing IT consulting and cybersecurity in {city}. Contact one of our expert IT staff at {phone} or send us an email at {email} today, and we can help you with all of your spyware and webcam spy prevention questions or needs.

You may have already heard about the massive data breach suffered by Yahoo – and hundreds of millions of their users – but only now are Yahoo spokespeople coming forward to finally officially confirm that yes, great damage has been done due to the hacking of the Yahoo corporate database.

 

It seems a hacker with the unlikely moniker of “Peace” is the one responsible for the badly-timed (or strategically-timed?) hack of the free email host and search engine. Reports have been up to 500 million affected users, but as of this week the number is down to 200 million user accounts whose information was subsequently sold to the Web data black market a.k.a. Dark Web. Apparently, the cost of 200 million Yahoo users’ personal data fetched “Peace” a mere $1,800. Wow, is that a cheap slap in the face to Yahoo aficionados! The data apparently includes user names, decrypted passwords, and personal information like birthdates and other email addresses.

The “official” announcement of the Yahoo hack  has been timed to coincide with news regarding the purchase of Yahoo by Verizon for $4.8 billion USD. Could the suddenly tamped-down numbers on user data be an perceptual easement for the Verizon shareholders, who are worried about an adjustment in the sale-price offering because of the hack? Quite likely.

No doubt part of the terms of the Yahoo acquisition will deal with users’ online security, and precisely the reason for the wait to make official announcements bundling the data hack info with the news of the Verizon purchase. Yahoo declined for months that the hack actually occurred, saying it was “aware of the claim” being made about it in recent months. They waited those many months to tell their users to reset their passwords immediately – something they have finally now done, though it will likely be a “too little, too late” situation for them as people (the ones left, anyway) jump to more secure email hosts and platforms.

The colossal Yahoo hack-and-dump is yet another black mark on the record of Yahoo CEO Marissa Mayer, a former Google exec on whose watch numerous other corporate foibles have occurred in recent years. Her failure to build Yahoo into a viable competitor to search engine giants Google and Bing partly led to the sale of her company to Verizon.

Let this be a cautionary tale, then, to executives and users alike – make security your number one priority, and (to users only) don’t ever share anything exploitable on obviously open and undefended sites like Yahoo that are, lets’ face it, already kind of a long-standing joke amongst serious, Web-savvy people who probably wouldn’t be caught dead sending a Yahoo email. And now, that “joke” has been confirmed as also being a personally-identifiable data trap.

Need Cyber Safety and Security Tips?

If you need advice on cyber defense and security, {company} is a proven leader in providing IT consulting and management in {city}. Contact one of our expert IT staff at {phone} or send us an email at {email} today, and we can help you with all of your needs.

 

The rate of cyber attacks and other cyber security incidents is continuing to rise. Experts have been speculating on which trends will continue to be problematic, and what new threats might lie ahead. Users and developers alike keep making the same mistakes over and over, creating vulnerabilities in the tech world that are tough to overcome. Most of these speculations cover the world of technology as a whole, but we’re going to focus on the issues that have the potential to impact your business.

 

Fully Automated Digital Extortion

The number of ransomware attacks leveled at businesses has been increasing since 2013. This specific type of malware works by encrypting user data and demanding a ransom fee in exchange for the decryption key. Another nasty type of malicious attack that has been increasing in popularity is doxing, which involves getting a hold of private or sensitive information and broadcasting it over social media or other digital platforms. Doxing typically targets an individual with the goal of humiliating or discrediting them.

As cybercriminals become more adept at using these tactics, there is a very real chance that they could be combined to blackmail or extort individuals to gain access to accounts and data related to their place of employment. And much like traditional forms of blackmail, there is nothing to stop a hacker from repeatedly coming back to make new demands over and over again. Because something like a ransomware infection can be triggered at random using typical phishing tactics, anyone could become a victim of this kind of extortion.

Compromised Smart Home Devices

A growing number of household appliances or other devices are becoming digitally enhanced, allowing users to monitor or activate parts of their home remotely, or having the items themselves interact with or respond to users and the environment. Just about every major manufacturer is getting in on the smart home market, with everything from stoves to light switches available with smart options. But it’s far from a perfect system. Most options are either too expensive or too complicated for typical users, and the bulk of the options available aren’t designed to communicate with devices from other manufacturers.

From a workplace standpoint, options like smart lights or smart thermostats can be picked up from commercial retailers and installed without much hassle. But eagerness from manufactures to make a splash in the marketplace is outweighing smart security decisions, leaving consumers vulnerable to hackers. A breach of your office’s smart thermostat could lead to data theft, high utility costs due to remote tampering with heat or A/C settings, or even damage to hardware caused by extreme temperatures.

Overall Failure of Companies to Perform Adequately in Regards to Security

Poor planning and failure to take the necessary security precautions is an ongoing theme in the world of technological innovations. The number one cause of data breaches and compromised security is the seeming inability of companies and manufacturers to learn from past mistakes and do better. Most, if not all, major security breaches could be prevented with common sense solutions, and thorough stress-testing of security measures.

Some of the most common security screw ups are:

• Failure to stay current with product updates and patches
• Failure to secure websites against SQL or other injection attacks
• Failure to encrypt stored user data
• Failure to separate OS files from data storage files on storage devices
• Leaving default configurations, setting, or account credentials in place

These are all standard security concepts that have been well established, but continue to be underutilized to the detriment of users. Part of the reason this continues to happen is the simple fact that tech enthusiasts are willing to act as beta testers for the chance to get first crack at a new program or device, instead of demanding that suppliers cover their bases and work out all the bugs before allowing a product to go to market.

Compromising Companies Through Employee-Focused Social Engineering Attacks

Business are getting smarter about their IT security, taking the right steps to protect against cyber attacks and being proactive about their security needs. But too often, businesses are still overlooking their biggest security weakness; their staff. Compromised employee credentials are an effective tool for hackers to infiltrate your business’ network, using the foothold provided to work their way deeper into your organization.

As IT infrastructure security continues to become more effective and comprehensive, hackers and scammers are turning their focus more directly towards employees. Your employees are only human, and that makes them susceptible to a whole host of social engineering attacks, like phishing scams, social network hoaxes, false security programs, or even blackmail. It’s much easier to fool a person than a sophisticated security system.

Testing the Security of the Cloud

Cloud computing is essentially just remote virtualization. A cloud provider sets up software, operating systems, or networking solutions that allows you business’ data to be stored on and accessed from servers that the provider maintains on their own premises. The cloud is an amazing tool that has done wonders for the technology landscape, and gives businesses the freedom to do things with their technology that are changing the business world for the better.

But relying on the cloud is not without its risks. Because your data is being stored somewhere outside of the carefully constructed security systems and protocols that protect your onsite infrastructure, you’re forced to rely on the cloud provider to have the same level of security for their own infrastructure.

These providers take the safety of your data very seriously, but the sheer volume of data they’re responsible for -and the businesses and entities that data represents – makes cloud providers a tempting target for hackers. If a breach were to happen to one of these providers, the resulting security compromise would affect dozens, if not hundreds of clients is a very public way. It’s a possibility your business needs to be aware of, as it could directly result in your own clients being compromised.

Technology has been evolving and improving in new and exciting ways for years, and will continue to do so for years to come. Shying away from new technology will do your business more harm than good in the long run. Just be cautious and ask questions before buying new software or hardware. That’s what your IT service provider is here for. Chances are we already know all about the newest options available to you before you even think to ask about it, and will gladly steer you in the right direction.

Have questions about your business’ IT infrastructure security? Contact us at {email} or {phone}. We’re the trusted IT experts for businesses in {city}.

Rather than hide away in shame, you should report your ransomware incident to the FBI, so the law enforcement agency urges. They are also discouraging victims from paying any ransom to cybercriminals (echoing the sentiments of most IT experts), as some strains of this file-encrypting malware will take your money and still destroy your files. This is all part of an effort on the FBI’s part to get a better sense of the problem and (one can only hope) start getting some leads and cracking down on relentless, ransomware-wielding hackers.

 

The FBI warning and incident-reporting urging comes on the heels of a forum convened by the Federal Trade Commission (FTC) during which FTC chairwoman Edith Ramirez remarked, “The spate of ransomware incidents are escalating at an alarming rate,” and also cited a Department of Justice estimate that ransomware incidents have gone up 300% in the past year. And, with new Department of Human Services regulations involving stricter HIPAA guidelines for healthcare facilities, the need to get a hold on the numbers of ransomware incidents and where they are coming from becomes even more urgent.

Although a report by Enigma Software shows that overall ransomware attacks actually decreased by 47.3 percent during the first half of 2016 over 2015, there are still estimates of as many as 100,000 malware and ransomware-infected computers daily in the U.S. alone. Head of Enigma Software Ryan Gerding said that while ransomware is accounting for a relatively small percentage of cyberattacks overall, they are growing at an astonishing rate.

“If you looked at the percentage of infections made up by ransomware in 2016, you would see a 119 percent spike from 2015. To us, this means malware makers may be shifting their attention to less common, but much more costly infections like ransomware,” said Gerding.

Enigma also broke down the number of ransomware incidents by location, citing the most ransomware-infected cities, with Tampa, St. Louis, Orlando, and Denver at the top of the list, in declining order. The cities with the fewest incidents of ransomware attacks (also in descending order) are Los Angeles, Riverside, CA, Albuquerque, and Wichita, Kansas.

Network World recently provided a list of ways you can thwart malware variants, which include:

• Enabling Two-Factor Authentication (2FA), or Multi-Factor Authentication (MFA)
• Audit your Login History and Use Tracking Code to Find Unauthorized Access Attempts
• Install Anti-Malware Software
• Implement All Recommended Security Updates
• Perform Offline Backups

Need More Help Fighting Ransomware?

If you have questions regarding preventing ransomware, {company} is a proven leader in providing IT consulting and cybersecurity in {city}. Contact one of our expert IT staff at {phone} or send us an email at {email} today, and we can help you with any of your cyber defense and security needs.

Many companies are having to re-think their disaster recovery strategies due mainly to the recent spike in ransomware attacks, but also because of malware infection in general. With ransomware sneaking into more IT systems than ever before, and at such an alarming rate, organisations and enterprises are having to put cyber security and disaster recovery on the front burner. Many companies were able to coast through for years without having to think much about catastrophic data loss, maybe updating an antivirus software program and tightening up a firewall here and there, but not anymore. Companies of any size must now run IT security “drills,” implement deeper and stronger security tools, and even establish employee education programs dealing with cyber safety along with implementing stronger Business Disaster Recovery (BDR) assurance.

 

Awareness is Everything

Because ransomware is so sneaky, and can slip in virtually undetected into computing environments cleverly disguised as a link or file in a legitimate-looking email, educating office staff on better cyber “hygiene” is perhaps the best step companies can take to prevent these malware infections on the front lines right now. Because security, disaster recovery, and business continuity begins and ends with human awareness and protocols – and are largely useless if the office staff engaging in cyber interfaces are clueless about what ransomware exploits look like or mimic – end-user policies and enforcement must accompany any use or investment in data protection technology.

The Appearance of Ransomware

Since many have no basic working understanding of what ransomware even looks like or how it operates, let’s take a closer look at it now. Ransomware uses encryption in a very aggressive, insidious way to lock-up your database, in effect, using a public-private key encryption interface or procedure to do so. It will quietly upload its file “payload” into your hard drive, but those files will stand out upon deeper examination. One such example looks like this:

The ransomware files are the “.png” and “.txt” files, where the file-encrypting and “ransom note” files, respectively, sit in your document queue. Ransomware can work so fast to encrypt and lock up your files now that total file encryption of your entire database can happen within a few minutes of you inadvertently clicking on a “mimic” email link. The ransom note will demand a certain amount of money – generally requested in Bitcoins – in order to obtain the private decryption key housed on a command and control (C&C) server which is running the operation remotely. A typical ransomware demand note looks like this:

When Endpoint Protections Fail

It’s a sad reality that even with what would be considered strong antivirus and firewall tools and employee cyber safety policies in place, ransomware is still finding its way to infecting databases across the land. This is because company policies on end-user interface are often too technical in nature for the average Joe and Jane to follow. And, cybercriminals are patching their own malware programs faster than anti-malware defense software can keep up. So, how do we combat this latter-day scourge that shows no signs of abating? It seems that only highly-coordinated strategising with department heads and IT support teams, along with technology experts (and strong cyber safety enforcement) will begin to put up a wall high enough to keep the ransomware hordes out. To quote a recent article in Nakivo.com: “Organisations must look at backups and specifically offsite backups as part of their disaster recovery/security incident strategy.”

Consequences and Better BDR Planning

We all know what the consequences can be of a ransomware strike. As such, having an offsite backup copy of your primary backups is essential to having a data protection strategy that works in case of disaster. It is, in fact, the lynchpin in an overall Business Disaster Recovery plan that will save your business from a ransomware attack.

A recent series of white papers released Global Knowledge and specifically authored by James Michael Stewart (CISSP, CEH, CHFI, ECSA, and Security+) reveal some startling yet unsurprising facts about our predicted-yet-probable cybersecurity future. They come in a series of 10 different predictions, and this article will synopsize or summarize the conclusions reached by Stewart and Global Knowledge (GK).

 

• Fully-Automated Digital Extortion. Ransomware as we know it could likely merge with another malicious activity known as doxing (or doxxing, which is where a personally-compromising dossier of information is hacked and released as a form of blackmail or libel) into something we could perhaps call ransom-doxing, whereby doxing dossiers are hacked and held for ransom in a “botnet cloud,” as James Stewart calls it, which results in a particularly vicious and personal form of ransomware or cyber blackmail.
• A Major Digital Payment System Will Be Hacked or Otherwise Compromised. We’ve already seen things like the Egyptian “test hacking” of PayPal, but Global Knowledge predicts that one of the bug-riddled “mobile payment systems” based on Apple Pay and Android Pay will be breached. This is after mobile payment systems get the bugs worked out of their systems and become widely used globally, creating “a fertile environment for multiple groups to fail to address security properly” according to the GK Report.
• Data Leaks Related to Wearables Will Occur. As wearables evolve and emerge into much greater popularity and use, their being networked via the Internet of Things and also containing personally-identifiable information – especially medical and financial – “could be used for a wide range of malicious social engineering attacks” according to the GK Report.
• The Failure of Smart Home Devices. “In 2016, it is likely that a well-known and fairly well-implemented smart device (or device ecosystem) will be compromised by hackers,” says the GK Report. This assertion is based on the ever-increasing use of and reliance on IP-oriented remotely controlled devices in the home like light bulbs, thermostats, and HVAC controls.
• Continuing Security Underperformance by Businesses. The GK Report goes on to speak of a continuation of the lack of cybersecurity that has caused so many cases of ransomware, malware, and other cyber breaches in huge corporate organizations. It speaks of further similar disasters mostly being caused by companies failing to adopt “common sense security solutions or by stress-testing their own implementations.”
• Ad and Script Blockers to Become Essential Internet Tools. With malvertising (malicious advertising), scareware, adware and other phishing schemes and viruses on the rise, the use of ad blockers and script blockers will be essential in order for PC and mobile device users to stem the flow of malicious code generated unscrupulous data-miners and hackers.
• An Increase in Employee-Focused Social Engineering Attacks. The GK Report claims that among the predicted continuation of social engineering attacks such as phishing scams, fake security programs, and phone/VoIP attack calls, that compromised employee credentials will actually emerge as the biggest social engineering threat of 2016.
• Cloud Computing Security Threats. Although cloud computing, a.k.a. remote virtualization has many benefits, the fact that your data is being stored in someone else’s building is not necessarily one of them. It actually poses more risk than if it were being housed inside a secure virtual private server (VPS) or cloud server under your own roof. This fact will continue to pose risks for business networks, and the potential of at least one major cloud service provider being heavily compromised is high in 2016 and beyond.
• Serious Security Breaches Involving Drones. Drones, as we all know, are both useful and pose risks to privacy and physical property and well-being. They can also be used to gain access to wireless networks or breach security in order to plant listening or monitoring devices. We will likely continue to see drones being involved not just in military strikes, but also cybernetic ones as well.
• Cyber Warfare Will Increase and Involve Civilians. It’s no secret that governments routinely engage in cyber warfare and hacking as a weapon of espionage and attack on foreign databases. Although private citizens have largely been left untouched by this, in the future we will likely see cyber warfare attacks that involve innocent civilians. This will probably cause outrage and a backlash against shadowy governments’ misuse of cybernetic power, resulting in laws that protect private citizens from state-sponsored cyberattack.

Ask a Cybersecurity Pro

If you need effective cybersecurity services, {company} is a proven leader in providing IT consulting and cybersecurity in {city}. Contact one of our expert IT staff at {phone} or send us an email at {email} today, and we will help you with any of your IT issues or needs.