December 5th, 2013
Phishing emails are a dangerous threat to anyone with an email address. Usually, there are some obvious signs that suggest a scam, but as Paul Ducklin of Naked Security explains, the absence of these signs doesn’t necessarily mean an email is legitimate.
The goal of most phishing scams is to steal your password for an online account. The email could contain a link that takes you to a legitimate looking log-in page. When you try to log-in, however, your information is sent directly to the criminal behind the scam. There are also emails containing malicious attachments. If you download and open the attachment, your computer will be infected with malware that could have a number of uses.
Some users believe that if an email with no link in the message, and either no attachment, or an attachment that shows no signs of malware after scanning with a security applicati0n, that email must be safe. But, criminals have other methods for stealing information.
Because most hackers know that users have become more cautious when opening links and attachments in emails, they’ve altered their tactics. An email may claim to be from a legitimate company and contain no links. It could have a clean attachment. However, the attachment may be a .pdf or word document containing a message and a link to a website. Many users are fooled into thinking that the link in the attachment is safer than if it had appeared in the body of an email, but that’s not the case. Usually, the link found in the attachment will also direct you to a malicious site used to steal your log-in credentials.
These sites designed created specifically to steal passwords are dangerous. Many are designed so that the ‘close’ button on the log-in box acts the same as the ‘submit’ button. This means that even if you decide at the last second not to log-in and try to close the log-in box, any information you put in will be sent anyway.
Unlike legitimate websites, these scam sites also don’t use ‘HTTPS’. That makes them more vulnerable to ‘sniffing’, or other parties being able to intercept any information you send through the site. So, not only does the criminal running the scam have your password, but anyone monitoring the activity on the site could too.
The best option for preventing yourself from becoming a victim of a phishing scam is to avoid them all together. If an email arrives in your inbox, make sure it’s from a trusted source. Check the sender’s address. Often, scam emails won’t be from the domain of the company they’re impersonating. Also, don’t download any attachments unless you know exactly what it is. Don’t follow links provided in emails. If you want to visit a site, enter it directly into your browser to be sure you’re visiting the legitimate site, not a spoof.
Web and spam filters and antivirus programs are also useful in keeping you safe in case you do click something you shouldn’t have. For help improving the security on your home PC or at the office, call Geek Rescue at 918-369-4335.
December 4th, 2013
A recent discovery of two million passwords to online accounts is making headlines. Violet Blue of ZDNet reports that a botnet is responsible for stealing users’ passwords to Facebook, Google, Twitter, Yahoo, one of the world’s largest providers of payroll services and more.
Though some have reported that the victims in this password heist are all located in the Netherlands, they’re actually believed to be spread across the globe. The criminal responsible used tactics to disguise his actions and make it look like the victims are all located in the Netherlands, but because of this it’s difficult to tell exactly where the passwords come from.
A tool called a Pony Botnet Controller is recognized as the root of this attack. It’s capable of stealing hundreds of thousands of passwords within only a few days of infection. In this particular infection, more than 1.5-million passwords to website’s were stolen along with 320-thousand email credentials, 41-thousand FTP credentials, 3-thousand remote desktop credentials and 3-thousand Secure Shell credentials.
When passwords are stolen in this manner, it should trigger action from all users regardless of whether they are actual victims. The stolen passwords become common knowledge for hackers. These passwords are used in lists that are part of hacking attempts on all kinds of online accounts. So, while your account may not have been compromised, someone with a similar password may have been, which in turn puts you at risk.
Shockingly, some of the most popular passwords found in this batch of stolen log-ins were extremely rudimentary. Almost 16-thousand of the stolen passwords were “123456”. “Password” was used over 2200 times and ‘admin’ accounted for almost 2000 of the stolen passwords. Overall, some form of the numbers 1 through 9 in order accounted for eight of the top ten most used passwords that were stolen.
This suggests that too many users are still using easy to remember, and incredibly easy to hack passwords for important accounts online. Using these passwords puts sensitive data at a significant risk. So, take this opportunity to create a stronger, original password for all of your accounts before you become a victim in the next attack.
If your computer is infected with malware, or you’d like to improve security to prevent an infection, call Geek Rescue at 918-369-4335.
December 3rd, 2013
As an internet user, you’re able to do more, access more and store more online than you’ve ever been able to before. Unfortunately, that makes your data more valuable to criminals than it has ever been before. Because of this, malicious tools used to steal your log-ins or personal information are rapidly on the rise. Tim Wilson, of Dark Reading, reports that over the past month there have nearly 344-thousand new malicious websites discovered. These websites vary in their design and goal, but all of them are being used by hackers to steal your identity, data or money or to infect your computer.
On average, this means there are about 11,500 new malicious website springing up every day, which significantly increases the likelihood that a typical user will stumble across one of these sites. About 173-thousand of these websites have been identified as malware distributors. These sites often download malware to your computer without any action being taken on your part, beyond simply loading the website. Many times this download will take place in the background, which means it could be weeks or months before you learn that you’ve been infected.
About 114-thousand of the malicious websites were labeled as phishing sites. These sites attempt to steal users log-ins and passwords. Usually, they’ll use the name and logo of a familiar site to attempt to fool visitors into thinking they’re on a trusted page. Most often in these examples, PayPal was used to gain access to accounts and steal users’ money. There has also been a rise of site designed to steal users’ Google log-ins. This is attributed to the fact that one Google log-in can give an individual access to Gmail, Google Drive and Calendar, Google+ and more.
These increasing threats illustrate the need for effective security on any device you use to access the internet. For help putting the proper security precautions in place at home or at your place of business, contact Geek Rescue at 918-369-4335. If you have a device that’s been infected with malware, bring it in to one of your convenient locations.
December 3rd, 2013
Apple introduced Touch ID as a security feature that recognizes a user’s fingerprint to unlock the iPhone 5S. That feature has come under scrutiny after security experts and hackers uncovered flaws and ways to by-pass it. Some users have also complained that Touch ID doesn’t always recognize their finger, or it takes too long to scan. Soon, Apple users may not have to worry about scanning fingers at all.
Lance Whitney, of CNet, reports that Apple has been granted a patent on an idea that would allow facial scanning to replace the current Touch ID feature.
The facial scanning function, which was patented under “Personal computing device control using face detection and recognition”, is still in its infancy. It appears, however, that Apple plans to make it a security feature on future products.
In many ways, it works the same as Touch ID does for your fingers. A user would start by scanning their own face and the face of anyone else they want to have access to their smartphone or tablet. The scan would record the shape, texture, color and size of your features and store them. Then, to unlock the device, you would have to again scan your face. Only registered users would be able to unlock the device, while unauthorized users would be stuck at the lock screen.
Calls, emails, texts and other notifications would also be locked behind the facial scanner. So, if a call comes in, your smartphone would scan your face before allowing you to answer.
Many of the same security flaws and workarounds that existed with Touch ID after it was introduced are still possible with facial scanning. A password would likely still act as a back-up for situations where the facial scan didn’t work, which opens the door for hacking. But, this is another interesting step for improved security on mobile devices.
If you’d like to improve the security on any of your devices, or you’re having problems like broken hardware, slow performance, or malware, bring your device to Geek Rescue or call us at 918-369-4335.
December 2nd, 2013
Cyber Monday marks the beginning of a busy online shopping season. Unfortunately, that’s well known information, which means criminals will be targeting shoppers hoping to cash in on the holiday season. To keep yourself, and your bank account, safe, Jennifer LeClaire of Lumension suggests doing your online shopping and banking on a mobile device.
Many users assume that a mobile device, like a tablet or smartphone, is less secure than their PC. This is usually only true because they’ve failed to take the same security precautions on their mobile device that they have on their laptop or desktop. With security apps in place, mobile devices can be much more secure because there are far fewer threats specifically targeting them.
There are certainly pieces of malware made specifically for Android, and to a lesser extent Apple’s iOS, but it pales in comparison to the threats being produced for PCs. Both Apple and Android provide security in their app store. As long as users don’t venture outside of the store to download unverified apps, they should have an entirely safe environment. PC users typically download more and take more risks online, which leaves their PC teeming with vulnerabilities and possible infections.
If your mobile device has an antivirus app installed, and is absent of any existing malware, you’ll have a great foundation for a secure online shopping season. You’ll still want to use smart surfing tactics, however. For example, don’t use public WiFi for any activity where you’re asked to log-in to an account, or provide payment information. Public WiFi provides no security for your data, which allows criminals to easily intercept any information you send over that network. So, while a mobile device may be more secure for online shopping than your PC, it shouldn’t be used just anywhere. Shop from home on your own, secured network.
Regardless of how you plan to do your online shopping this year, you need to take the proper precautions. To secure any of your devices, remove viruses and malware, or to create a more secure network at home or the office, call Geek Rescue at 918-369-4335.
December 2nd, 2013
When you visit your bank’s website, most retailers or a credit card’s website, you might notice that the address starts with “HTTPS”. The added ‘S’ stands for secure. That’s ‘Hypertext Transfer Protocol Secure’ all together. It denotes that the site you’re using is safe from hackers stealing your log-in information. While that may have been true at one time, Rohit Sethi writes for USA Today that HTTPS alone no longer provides complete security for users.
HTTPS remains a useful tool to keep users secure, but it can’t do the job alone. Hackers have already exposed some areas of weakness. In another two to five years, successful attacks on HTTPS could become so common that an entirely new structure will be needed.
When using a site with HTTPS, your data is encrypted so that no third party will be able to steal it. However, attacks have already taken place that allow hackers to bypass this security. This means that log-in information for important online accounts, like for banking sites, is easily stolen by criminals in less than a minute. For both websites and users, this poses a particular problem because both parties believe in the security HTTPS is supposed to provide.
Users must understand that an HTTPS included in a URL and a small lock icon no longer provides enough security. Fortunately, there are other ways to keep your data safe. A Virtual Private Network, VPN, is one valuable tool. It provides an extra layer of encryption for all of your browsing activity. Many VPNs contain the same type of security flaws that have been exploited in HTTPS, so do some research and find a VPN using IPsec.
Smart, safe surfing habits also go a long way in protecting your data. Unsecured wireless networks provide little security, so if you’re using one, don’t log-in to any of your online accounts. Also, consider having a credit card dedicated to online purchases. This way, if that card is compromised, a criminal won’t have access to your entire bank account and you should notice quickly.
If you’d like to improve security for any device at home or at the office, or if you need to upgrade security for your website, call Geek Rescue for help at 918-369-4335.
November 29th, 2013
Buying a new computer is a great feeling. You get to start fresh with plenty of available storage space and you know there’s no malware or viruses slowing down performance. In order to keep your computer working properly and staying new for as long as possible, there are a few things you need to do as soon as you boot up for the first time. Andy O’Donnell of About lists the initial steps you should take with any new computer to ensure it’s secure and protected.
Your computer may be brand new, but that doesn’t mean the operating system and browser your using are up to date. Chances are there are updates to download and security patches to install. Without installing these, you leave yourself vulnerable to bugs and known holes in security that hackers can easily take advantage of. Your new computer won’t stay new for long if you fail to keep it up to date.
The first thing you should install on any new device is software to help keep it secure. There are a number of antivirus programs available for free, or a small fee. An anti-malware program is also helpful and a firewall is essential. Ideally, you’ll be able to research the best programs available before you boot up your new computer. That way, you’ll be able to download them quickly and you won’t be unprotected for long. As with your OS and other applications, it’s vital that you keep all security software updated and patched to keep it as effective as possible.
Once you’ve put protective measures in place, you’ll want to plan for disaster. Even with security software and updates installed, there are still plenty of ways to lose important data. Hackers, natural disasters and theft are all still possible. So, put a plan in place to regularly back-up your most important data to ensure that, even in a worst case scenario, you’ll be able to restore files as quickly as possible.
For help with any of these important steps with your new device, bring it to Geek Rescue or call us at 918-369-4335. We also fix computers to save you from having to purchase a new one.
November 29th, 2013
There are a number of precautions you need to take in order to stay safe online. From firewalls to updated antivirus software, there are plenty of tools that can prevent a disastrous cyber attack or data breach. These tools still don’t guarantee your safety, however. Even with precautions in place, it’s important to understand where the majority of threats come from and avoid them altogether with safe surfing techniques. Ron Johnson, of Business2Community, listed some of the most common causes of security breaches and how to avoid them.
Open WiFi networks are found nearly everywhere you go, but they’re far from secure. Any data you send over public WiFi is easily intercepted and stolen by a third party. This doesn’t mean you shouldn’t ever connect to public WiFi. It means you need to be extra careful about what sites you access while using this type of unsecured network. Viewing and reading websites likely won’t cause a problem, but don’t log-in to any online accounts or your password could be compromised.
Most users understand the dangers in giving other people their password, but sometimes even the most savvy users give out their log-in information without even thinking about it. For example, if you’re having difficulty with an account, a customer service representative might ask you for your password. This doesn’t necessarily mean they are going to misuse it, but it’s always a good idea to change passwords once you’ve told them to anyone, including a help desk. They might not always be as careful with your information as you would be. It’s also never a good idea to share accounts with others, even friends or family. If you want to allow another individual to access your account, change the password, give them the new log-in information, then change it again once they’re finished.
Downloading anything should be a decision that every user is cautious of. Even seemingly trusted websites can be compromised and a file you download could end up infecting your system with malware. If you’re prompted to download an application, like a media player, go to that player’s official website to download. Be sure to scan every file downloaded with your antivirus program before opening. As for email attachments, don’t download them unless you were expecting a file to be sent to you and you know exactly what it is.
Speaking of email, phishing scams are a popular method for stealing your information and hacking into your online accounts. These scams have grown more sophisticated. Often, an email will appear to be from a legitimate website where you hold an account. It will claim there’s been a problem and you need to log-in immediately, or download software, or even put in credit card information. If you have any questions about the legitimacy of these emails, contact the website or business directly, by phone if possible. There’s never a time when a business will email and need your credit card information.
By learning some of these common hacker tactics, you’ll be able to be smarter about your online habits and avoid potential threats.
If you’d like to improve security at your home or business to further safeguard from malware, phishing scams, hacking and more, contact Geek Rescue at 918-369-4335.
November 27th, 2013
A new piece of malware, a trojan called ‘Neverquest’, has security experts scrambling and forecasting a number of future attacks. As Lucian Constantin of Computer World reports, Neverquest has the ability to spread quickly and steal your financial information.
It’s believed that the Neverquest trojan originated in July, but the first attacks didn’t occur until months later. Now, experts have spotted thousands of uses of Neverquest and they expect to see that number spiral out of control soon.
In many ways, Neverquest is similar to other malware that targets financial websites. It’s able to insert its own forms into websites opened in Internet Explorer and Mozilla Firefox. It steals log-in information entered into these malicious forms and can also control your computer remotely.
Those are scary features, but that’s not all Neverquest can do. The trojan comes with 28 websites where criminals will be able to steal log-ins that control finances. These are the most popular banking sites and online payment services. To expand the number of sites it’s used with, and to ensure that every infected user is at risk, the trojan also monitors a victim’s activity and searches sites visited for keywords like ‘account summary’ or ‘balance’. When it discovers those sites, it alerts it’s host so they can begin attacking those sites as well.
In order to gain access to your computer, hackers first infect websites. When you visit one of these infected websites, vulnerabilities in browser plug-ins are used to install malware directly onto your hard drive. Spam email and links sent over social media are also used to infect users.
To keep your computer, and bank account information safe, don’t follow suspicious looking links and don’t visit untrusted websites. Keep your antivirus program running and up to date, as well.
If you have malware, trojans or viruses on your computer, bring it to Geek Rescue or call us at 918-369-4335. We clean infected machines and help you protect against future attacks.
November 27th, 2013
There are a number of reasons to focus more on security for your mobile device, or the mobile device of your employees. For personal use, 7-percent of smartphone owners have been the victim of identity fraud, which is a substantially higher rate than the rest of the population. For businesses, about two-thirds use the bring your own device model, but only about 4-percent manage the company data their employees access with personal devices. In both of these examples, the issues stem from a lack of mobile security. Eyal Manor, of Information Week, writes that companies must focus on the data being accessed by employees, rather than the devices themselves, to improve security.
Many smartphone users don’t keep their apps and operating system updated, which opens security holes. Many don’t use a passcode either. There’s more and more mobile specific malware being introduced every day. These would be reasons to institute mobile device management, but when employees are using their personal devices, it’s difficult for more businesses to demand that type of access and control. Instead, here are three ways to improve security by focusing on the data being accessed, rather the individual device.
This tactic takes all of business-centric data stored on an employees device and locks it down in a special, encrypted area. Rather than putting controls on the entire device, companies are able to control only the encrypted area allowing them to ensure the safety of company data.
Users may not have strict security in place to restrict who can access their device, but for company information enhanced authorization can be installed so that data isn’t compromised in the case of theft or a lost device. Similar to containerization, only vital company data would be stored behind additional walls, which would require an employees log-in information to get through.
Regardless of the other safety measures taken to protect data, if it’s not encrypted, it isn’t safe. Hackers are continually evolving their tactics to get past enhanced security, so data theft remains a possibility. If your data is encrypted, however, you take added precautions that stolen data can’t be accessed by a third party, and won’t come back to damage your company. Remember that encryption is important both for stored data, and for data being sent between two parties.
For help improving the security of your company’s data, call Geek Rescue at 918-369-4335.
