about
now browsing by tag
How to talk to your partner about dating safely during the pandemic | #tinder | #pof | romancescams | #scams
During the pandemic, many couples and singles have had to find safe ways to date and see each other. As it gets colder, it is now time to have another […] View full post on National Cyber Security
Board of Education Candidate Talks With High School Students About Virtual Learning | #Education | #parenting | #parenting | #kids
Board of Education Candidate Talks With High School Students About Virtual Learning | #Education | Parent Security Online ✕ Parent Security Online FREE VIEW […] View full post on National Cyber Security
Why there’s reason to be skeptical about Trump’s drug pricing order | #tinder | #pof | romancescams | #scams
President Trump released an executive order on Sunday ordering the Department of Health and Human Services to begin the process of limiting what Medicare pays for prescription drugs relative to […] View full post on National Cyber Security
#parent | #kids | I’m a New Dad Scared About Pandemic-Era Day Care Safety. There’s Only One Expert I Wanted to Call. – Mother Jones | #parenting | #parenting | #kids
Rob Dobi The coronavirus is a rapidly developing news story, so some of the content in this article might be out of date. Check out our most recent coverage of […] View full post on National Cyber Security
#sextrafficking | Fact check: Media was not “silent” about the NXVIM case | #tinder | #pof | #match | romancescams | #scams
Users on social media are sharing the screenshot of a 2019 tweet that misleadingly alleges the media did not report the NXVIM case, a U.S. sex cult founded by Keith […] View full post on National Cyber Security
Doctor answers your coronavirus questions about COVID-19 vaccine trial, antibodies, kids | #covid19 | #kids | #childern | #parenting | #parenting | #kids
During ABC7’s Ask the Doctor live stream Tuesday, Dr. Daisy Dodd, an infectious disease specialist from Kaiser Permanente, answered your questions about the coronavirus.Dodd discussed the effect of COVID-19 on […] View full post on National Cyber Security
WhatsApp “Martinelli” hoax is back, warning about “Dance of the Pope” – Naked Security
Source: National Cyber Security – Produced By Gregory Evans
If you follow @NakedSecurity on Twitter, you’ll have noticed that we warned last week about an old WhatsApp hoax that suddenly reappeared.
The bogus news is generally known as the “Martinelli hoax”, because it starts like this:
If you know anyone using WhatsApp you might pass on this. An IT colleague has advised that a video comes out tomorrow from WhatsApp called martinelli do not open it , it hacks your phone and nothing will fix it. Spread the word.
When we last wrote about “Martinelli”, back in 2018, we noted that the hoax was given a breath of believability because the text above was immediately followed by this:
If you receive a message to update the WhatsApp to WhatsApp Gold, do not click!!!!!
This part of the hoax has a ring of truth to it.
Back in 2016, hoax-checking site Snopes reported that malware dubbing itself WhatsApp Gold, was doing the rounds.
The fake WhatsApp was promoted by bogus messages that claimed, “Hey Finally Secret WhatsApp golden version has been leaked, This version is used only by big celebrities. Now we can use it too.”
So WhatsApp Gold was actual malware, and the advice to avoid it was valid, so the initiator of the Martinelli hoax used it to give an element of legitimacy to their otherwise fake warning about the video.
The latest reincarnation of the hoax has kept the text of the original precisely, including the five-fold exclamation points and the weird extra spaces before punctuation marks.
The new hoax even claims that the video first mentioned several years ago still “comes out tomorrow.”
But there’s a new twist this time, with yet another hoax tacked on the end referring to yet another video “that formats your mobile.”
This time, the video is called Dance of the Pope:
Please inform all contacts from your list not to open a video called "Dance of the Pope". It is a virus that formats your mobile. Beware it is very dangerous. They announced it today on BBC radio. Fwd this message to as many as you can!
Ironically, Snopes suggests that this piece of the hoax – which is basically the same as the Martinelli hoax but with a different video name – is even older than the Martinelli part, dating back to 2015.
Quite why the hoax has reappeared now is not clear, though it may have been triggered by March 2020 news headlines about wunderkind Brazilian footballer Martinelli.
Martinelli currently plays for Arsenal in England, but has been tipped to appear in the Brazilian national squad at just 18 years of age; he’s also been the subject of media speculation that he might get poached from Arsenal by Spanish heavyweights Real Madrid.
Is it even possible?
In theory, playing a deliberately booby-trapped video file on your mobile phone could end up in a malware infection, if your phone has an unpatched bug in its media player software that a crook could exploit.
In practice, however, that sort of bug is very rare these days – and typically gets patched very rapidly and reported very widely.
In other words, if the creator of this warning knew enough about the “bug” to predict that it could infect any mobile phone, and could warn you about this “attack” in a video that isn’t even out yet, it’s highly unlikely that you wouldn’t have heard about the actual bug itself either from the vendor of your phone or from the world’s cybersecurity news media.
Additionally, even if there were a dangerous bug of this sort on your phone and your phone were at risk, it’s unlikely that “nothing would fix it”.
As for the imminent and unconquerable danger of an alleged double-whammy video attack of “threats” that first surfaced in 2015 and 2016…
…well, if the videos were supposed to “come out tomorrow” more than four years ago, we think you can ignore them today.
What to do?
- Don’t spread unsubstantiated or already-debunked stories online via any messaging app or social network. There’s enough fake news at the moment without adding to it!
- Don’t be tricked by claims to authority. Anyone can write “they announced it today on BBC radio,” but that doesn’t tell you anything. For all you know, the BBC didn’t mention it at all, or announced it as part of a hoax warning. Do your own research independently, without relying on links or claims in the message itself.
- Don’t use the “better safe than sorry” excuse. Lots of people forward hoaxes with the best intentions, but you can’t make someone safer by “protecting” them from something that doesn’t exist. All you are doing is wasting everyone’s time.
- Don’t forward a cybersecurity hoax because you think it’s an obvious joke. What’s obvious to you might not be to other people, and your comments may get repeated as an earnest truth by millions of people.
- Don’t follow the advice in a hoax “just in case”. Cybersecurity hoaxes often offer bogus advice that promises a quick fix but simply won’t help, and will certainly distract you from taking proper precautions.
- Patch early, patch often. Security updates for mobile phones typically close off lots of holes that crooks could exploit, or shut down software tricks that adware and other not-quite-malicious apps abuse to make money off you. Take prompt advantage of updates!
- Use a third-party anti-virus in addition to the standard built-in protection. Sophos Intercept X for Mobile is free, and it gives you additional protection not only against unsafe system settings and malware, but also helps to keep you away from risky websites in the first place.
- Don’t grant permissions to an app unless it genuinely needs them. Mobile malware doesn’t need to use fancy, low-level programming booby-traps if you invite it in yourself and then give it more power that it needs or deserves.
The post WhatsApp “Martinelli” hoax is back, warning about “Dance of the Pope” – Naked Security appeared first on National Cyber Security.
View full post on National Cyber Security
#nationalcybersecuritymonth | DNC warns campaigns about cybersecurity after attempted scam
Source: National Cyber Security – Produced By Gregory Evans
An online “impersonator” of a Democratic National Committee (DNC) staffer tried to contact presidential campaigns, including Sen. Bernie SandersBernie SandersWinners and losers from the South Carolina debate Five takeaways from the Democratic debate Sanders most searched, most tweeted about candidate during Democratic debate MORE’s (I-Vt.) campaign, the committee said in a statement to the candidates Wednesday.
Bob Lord, the DNC’s chief security officer, wrote in an email to the campaigns that “adversaries will often try to impersonate real people on a campaign,” The Associated Press reported.
He added that the “adversaries” could try to get campaign workers to “download suspicious files, or click on a link to a phishing site” or set up calls or in-person meetings to record and release.
Lord warned that the “impersonator” contacted the Sanders campaign and at least two others and had a domain registered overseas. But he acknowledged that anyone can register a domain name in any country.
“Attribution is notoriously hard,” he wrote. “The appropriate authorities have been alerted.”
“If you are using an alternate domain, please refrain from doing so and let us know if you are operating from a domain that others have not corresponded with before,” Lord added. “Do not use your personal mail account for official business.”
Sanders campaign spokesman Mike Casca confirmed the incident with the AP and said the domain was registered in Russia.
“It’s clear the efforts and investments made by the DNC and all the campaigns to shore up our cybersecurity systems are working,” Casca said, according to the AP. “We will remain vigilant and continue to learn from each incident.”
The Hill reached out to the DNC and the Sanders campaign for confirmation.
The Vermont senator said on Friday that he was briefed about a month ago that Russia was attempting to boost support for his campaign.
Democratic campaigns have been cautious about cybersecurity since Hillary Clinton
Hillary Diane Rodham ClintonDemocratic insiders stay on the sidelines in 2020 race Hillicon Valley: Twitter falling short on pledge to verify primary candidates | Barr vows to make surveillance reforms after watchdog report | DHS cyber chief focused on 2020 The Hill’s Campaign Report: High stakes at last Democratic debate before Super Tuesday MORE campaign chairman John Podesta’s emails were hacked and published after he received an email seemingly from Google directing him to change his account.
The post #nationalcybersecuritymonth | DNC warns campaigns about cybersecurity after attempted scam appeared first on National Cyber Security.
View full post on National Cyber Security
Data about inmates and jail staff spilled by leaky prison app – Naked Security
Source: National Cyber Security – Produced By Gregory Evans
Inmates’ and correctional facilities employees’ data has been sloshed onto the web, unencrypted and unsecured, in yet another instance of a misconfigured cloud storage bucket.
Security researchers at vpnMentor came across the leak on 3 January during a web-mapping project that was scanning a range of Amazon S3 addresses to look for open holes in systems.
The leaky bucket belongs to JailCore, a cloud-based app meant to manage correctional facilities, including by helping to ensure better compliance with insurance standards by doing things like tracking inmates’ medications and activities. That means that the app handles personally identifiable information (PII) that includes detainees’ names, mugshots, medication names, and behaviors: going to the lavatory, sleeping, pacing, or cursing, for example.
JailCore also tracks correctional officers’ names, sometimes their signatures, and their personally filled out observational reports on the detainees.
Some of the PII is meant to be freely available to the public: details such as detainee names, dates of birth and mugshots are already publicly available from most state or county websites within rosters of current inmates. But another portion of the data is not: that portion includes specific medication information and additional sensitive data, vpnMentor says, such as the PII of correctional officers.
JailCore closed down the data leak between 15 and 16 January: 10 or 11 days after vpnMentor notified it about the breach (and about the same time that the security firm reached out to the Pentagon about it). The company initially refused to accept vpnMentor’s disclosure findings, the firm said.
Risk of identity theft
The leaky bucket held 36,077 PDFs of data from an Amazon server belonging to JailCore. The security researchers didn’t open each file, but the records that they did open pertained to correctional facilities in Florida, Kentucky, Missouri, Tennessee and West Virginia.
JailCore says that it’s a startup that’s currently working with six jails, totaling 1,200 inmates. It thinks that a tiny portion of real people’s information was involved in the breach. From one of its comments cited by vpnMentor:
Of those 6 jails, only 1 is using the application to track medication compliance in a 35 inmate jail and only 5 of those 35 inmates in that jail has a prescribed medication. Meaning all other reports with any mention of medication were all used for demonstration purposes only.
JailCore asked vpnMentor to bear in mind that detainees aren’t free citizens, and that’s a whole ‘nuther can of worms when it comes to privacy rights:
These are incarcerated individuals, not free citizens. Meaning, the same privacy laws that you and I enjoy, they do not.
[…] You cannot look at this like an example of a private citizen getting certain private information hacked from the cloud. These are incarcerated individuals who are PROPERTY OF THE COUNTY (this is even printed on their uniforms) … they don’t enjoy our same liberties.
Does that mean that it’s OK to expose prison inmates to the risk of identity theft? vpnMentor’s take on that risk:
Knowing the full name, birthdate, and, yes, even the incarceration record of an individual can provide criminals with enough information to steal that person’s identity. Considering that the person whose identity is stolen is in jail, cut off from normal access to a cellphone or their email, the damage could be even greater, as it will take longer to discover.
When Vice’s Motherboard contacted JailCore, a representative acknowledged that the records were in fact generated by its app and confirmed that JailCore had sealed up the hole. The JailCore rep also told the publication that the company doesn’t think that any of the compromised PII is personally sensitive or compromising in any way.
A tub full of leaky buckets
And thus does JailCore join the Who’s Who list of organizations that have misconfigured their Amazon S3 buckets and thereby inadvertently regurgitated their private data across the world: Dow Jones; a bipartisan duo including the Democratic National Committee (DNC) and the Republican National Committee (RNC); and Time Warner Cable – to name just a few.
In fact, back in 2017, security vendor Threat Stack conducted a survey of 200 AWS users in early 2017 and found that 73% left SSH open to the public, and 62% weren’t using two-factor authentication (2FA) to secure access to their data.
Amazon took a proactive step by scanning its customers’ S3 buckets and sending warnings when it found spillage, reaching out to customers with bad security before crooks had a chance to.
It doesn’t have to be this way. There’s help out there for organizations that can take a deep breath, step away from their servers, and plunge in to learn how to better secure them: Amazon has an FAQ about how to access AWS Simple Storage Service (S3) controls and encryption.
The post Data about inmates and jail staff spilled by leaky prison app – Naked Security appeared first on National Cyber Security.
View full post on National Cyber Security
#deepweb | George Pyle: Lee deeply wrong about the ‘deep state’
Source: National Cyber Security – Produced By Gregory Evans It can be difficult for normal people to know when to trust the government and when not to. It can be even more confusing to figure out when to trust Mike Lee. The senior senator from the great state of Utah has, on occasion, stood up […] View full post on AmIHackerProof.com
D5 Creation