their
now browsing by tag
#cybersecurity | #hackerspace | But Their Emails: Many 2020 Campaigns Still Risk Phishing Attacks
Source: National Cyber Security – Produced By Gregory Evans
Phishing is still a vector to attack presidential campaigns. Many 2020 candidate organizations still aren’t using best practice by implementing a proper DMARC policy.
It seems they’ve not learned from the hack on Hillary’s campaign. In 2016, John Podesta got tricked by a crude phish—and it easily could happen again.
Things are better now, but there’s still acres of room for improvement. In today’s SB Blogwatch, we dig their DNS records.
Your humble blogwatcher curated these bloggy bits for your entertainment. Not to mention: a decade in three minutes.
Can You Spell DMARC?
What’s the craic, Zack? Mister Whittaker reports—“Only a few 2020 US presidential candidates are using a basic email security feature”:
DMARC, an email security protocol that verifies the authenticity of a sender’s email and rejects spoofed emails … could prevent a similar attack that hobbled the Democrats during the 2016 election. … Only Elizabeth Warren … Joe Biden, Kamala Harris, Michael Bloomberg, Amy Klobuchar, Cory Booker, Tulsi Gabbard and Steve Bullock have … improved their email security.
…
The remaining candidates, including … Donald Trump, are not rejecting spoofed emails. … That, experts say, puts their campaigns at risk from foreign influence campaigns and cyberattacks.
…
In the run-up to the 2016 presidential election, Russian hackers sent an email to Hillary Clinton campaign manager John Podesta, posing as a Google security warning. [It] tricked Podesta into … allowing hackers to steal tens of thousands of private emails.
Or perhaps you prefer a different topical angle? G’day, David Braue—“You may be targeting Black Friday bargains, but cybercriminals are targeting you”:
Security firms are warning shoppers to be careful online as cybercriminals increase their activity in the runup to [the] retail season. … Shoppers need to be particularly wary of online scams and malware propagated through emails spoofing legitimate retailers.
…
Despite efforts by the Australian Signals Directorate to promote the use of next-generation DMARC email anti-fraud tools … research suggests that just 45 percent of Australia’s biggest online retailers have actually begun implementing DMARC – and just 10 percent have adopted the strictest level of security.
Returning to this hemisphere, Agari’s Armen Najarian claims, “2020 Presidential Candidates Remain Vulnerable”:
The kinds of email attacks that helped derail Hillary Clinton’s candidacy in 2016 are only getting more sophisticated. [But some] campaigns are not taking the threat as seriously as they should.
…
Meanwhile, we’re seeing new trends in how cybercriminals execute … advanced threats, which are liable to throw an entire candidacy off-course. After all, it only requires one campaign employee or volunteer to click on one link in a malicious email.
…
It’s likely only a matter of time before the unthinkable happens once again. … The Mueller Report … squarely pointed to spear phishing as the primary attack vector for Russian hackers seeking to gain access.
…
Unfortunately, candidates must not only be concerned about email directed to them and their campaign staff. … Imagine the damage that can be done by emails that appear to come from the legitimate domain of the candidate, but actually come from a malicious criminal who uses that domain to spread false information to potential … donors, voters, and the media.
…
This is entirely possible, and likely even probable, unless candidates take the steps they need to protect against it by implementing DMARC with a p=reject policy.
DMARC: HOWTO? Chad Calease obliges—“A Definitive Guide”:
This is the time of year we’re all too aware how much phishing really sucks. … While technology isn’t able to catch all of it 100% of the time, DMARC is one of these important layers of defense that helps to dramatically minimize the amount of phishing emails that get through to our inboxes.
…
DMARC stands for Domain-based Message Authentication, Reporting & Conformance. [It] is a set of 3 DNS records that work together to ensure email is sent only from authorized … mail servers, thereby helping block fraudulent messages.
…
DMARC sets a clear policy for what to do if a message hasn’t been sent from an authorized source. … DMARC helps prevent criminals from spoofing the “header from” or “reply-to” address: … First it checks that the DKIM … digital signature is a match. Then it checks the SPF record to ensure the message came from an authorized server. If both DKIM and SPF pass these checks, DMARC delivers the message.
…
But if one or more of these tests fails, DMARC behaves according to a policy we set:
…
‘none’ [which] doesn’t impose any actions …
‘quarantine’ [which] Flags messages … to be directed to the recipients’ spam or junk folders …
‘reject’ [which] outright refuses messages that fail … (this is the end goal of a good DMARC configuration).
OK, so why aren’t all the candidates on board? Here’s lostphilosopher:
I see this as a reflection of the candidates ability to find and listen to experts. I don’t expect a candidate to understand how to do tech “right” – I’m in the industry and still get half of it wrong! However, when you’re running a multi million dollar campaign you can afford to bring in experts to set this stuff up and audit your practices.
…
I assume these candidates are already doing this and that if they are still not following some basic best practices it’s because they are actively ignoring the experts. … That’s what worries me: If they can’t find or listen to these people now, what makes me think they’ll be able to in office?
And this Anonymous commentator agrees:
Think about this for a second! If the … candidates don’t care enough about their own email traffic, why would anyone vote for them to secure this nation? If your own private info is easily up for grabs, what do you honestly think national security would be like under any of them?
But gl4ss spots an oint in the flyment:
If you rely on DMARC … and just trust it blindly then you know what? You’re gonna get ****ed by someone on whthouse.org.co.uk.acva.com.
Sure the email is sent from that domain, but so what? The domain isn’t right.
It was ever thus. Ryan Dunbar—@ryandunbar2—looks back:
In 1980 we knew internet email was not secure.
2003 get email SPF
2007 get email DKIM
2012 get DMARC
2019 get ARC, BIMI
2025 get QUIC, yet email will still not be secure.
2050 get internet3
Why does it look like the ones running the internet don’t want a secure internet?
Meanwhile, El Duderino knows who to blame:
This is Al Gore’s fault because he invented the internet.
And Finally:
10 Years; 100 songs; 3 minutes
Previously in And Finally
You have been reading SB Blogwatch by Richi Jennings. Richi curates the best bloggy bits, finest forums, and weirdest websites… so you don’t have to. Hate mail may be directed to @RiCHi or sbbw@richi.uk. Ask your doctor before reading. Your mileage may vary. E&OE.
Image source: Tia Dufour (public domain)
The post #cybersecurity | #hackerspace |<p> But Their Emails: Many 2020 Campaigns Still Risk Phishing Attacks <p> appeared first on National Cyber Security.
View full post on National Cyber Security
#deepweb | 30 years after the Convention on the Rights of the Child was signed, the IACHR calls on States to renew their commitment to children – World
Source: National Cyber Security – Produced By Gregory Evans
Washington, D.C. – On November 20, when the Convention on the Rights of the Child celebrates its 30th anniversary, the IACHR recalls that children still face enormous barriers to the enjoyment of their rights. In this regard, the Commission calls on the OAS member states to renew their commitment to children and adolescents through the implementation of effective national protection systems.
Thirty years ago, the international community came together to take a crucial step in the protection of children around the world, by negotiating and approving a broad regulatory framework that meant a paradigm shift in the matter. It is from the Convention that the States consolidated the recognition of children as holders of their own rights, universally guaranteed, and not as mere objects of protection. Today, the Convention on the Rights of the Child is the human rights treaty with the highest number of ratifications, as it has 196 States Parties, which underlines the universality of its scope.
Although the Commission recognizes the progress achieved during the three decades since the Convention came into force, it also expresses its concern about the deep gap between the rights established therein and the reality in which millions of children live in the region. According to UNICEF, in Latin America alone, 72 million children aged 0 to 14 still live in poverty, 1 in 5 have their physical growth affected by the lack of access to adequate nutrition and 12 million do not attend to school. In addition, almost 25,000 adolescents between 10 and 19 years old are victims of homicide each year in the region and half of those under 15 years of age are subjected to corporal punishment at home.
This scenario requires that the States renew and strengthen their commitment to protect children from any type of violation of their rights. In this regard, the Commission reiterates the need for States to implement national systems that effectively execute special and reinforced public protection policies aimed at guaranteeing the integral development of children, as well as allowing them to live a dignified life and free from all forms of violence.
“The protection of the rights of children requires a joint effort of all social actors, not only at this time of celebration of the 30th anniversary of the Convention, but permanently, with the States occupying a central place in guaranteeing these rights”, said Commissioner Esmeralda Arosemena de Troitiño, President of the IACHR and Rapporteur on the Rights of the Child. “This renewed commitment, which must continue through the years, needs to hear the voice of children who have the right and are increasingly interested in participating in the decisions that affect them”, she added.
The Commission notes that the United States of America is the only country that has not ratified the text of the Convention. In this regard, the IACHR takes this opportunity to urge the State to adopt measures to ratify the treaty for the benefit of more than 70 million children living in the United States.
A principal, autonomous body of the Organization of American States (OAS), the IACHR derives its mandate from the OAS Charter and the American Convention on Human Rights. The Inter-American Commission has a mandate to promote respect for and to defend human rights in the region and acts as a consultative body to the OAS in this area. The Commission is composed of seven independent members who are elected in an individual capacity by the OAS General Assembly and who do not represent their countries of origin or residence.
Source link
——————————————————————————————————
The post #deepweb | <p> 30 years after the Convention on the Rights of the Child was signed, the IACHR calls on States to renew their commitment to children – World <p> appeared first on National Cyber Security.
View full post on National Cyber Security
#cyberfraud | #cybercriminals | American Consumers Recognize Their Role in Preventing Cybercrime, are Bothered by Perceived Inconveniences of Advanced Security
Source: National Cyber Security – Produced By Gregory Evans
BROOKFIELD, Wis.–(BUSINESS WIRE)–
55% of consumers understand they need to do more to protect their personal data; but 59% are bothered by temporary inconveniences of advanced security measures
Only 45% of consumers have received formal cybersecurity training from their employer
According to the 2019 Cybersecurity Awareness Insights Study released today by Fiserv, most Americans consider themselves at least somewhat informed of cybersecurity threats, yet many fall short at proactively protecting their personal data. Despite this lack of action, more than half (55%) of American consumers understand they need to do more to protect their data, presenting significant opportunity for businesses to reinforce best practices.
Conducted in the summer of 2019 and originally commissioned by First Data, now Fiserv, the study gathered insights from 1,005 Americans ages 18 to 73. The study explores how aware American consumers are of online privacy and security risks, and how they behave when it comes to protecting themselves from cyber threats.
“While cybercrime continues to grab headlines, our study shows that many Americans have not taken action to protect themselves, and the majority say they are bothered by temporary inconveniences brought about by advanced security measures,” said Jay Ablian, Head of Merchant Security and Fraud Solutions, Fiserv. “There is a clear opportunity for businesses to educate consumers and employees to help them understand both the potential impact of inaction and how security measures are designed to protect them.”
Consumer Awareness
The more consumers know, the better they’re able to protect their personal information online. According to the 2019 Cybersecurity Awareness Insights Study, 75% of consumers consider themselves at least somewhat informed of cybersecurity threats. In addition, 55% of respondents understand they should do more to beef up their online security – especially when using social media, online banking, or online shopping.
Despite this, more than half of consumers can be classified as ambivalent, in denial, or oblivious to cybersecurity risks, with only 6% currently taking the steps needed to proactively protect themselves.
Consumer inaction may be driven by perceived inconveniences. To that end, 59% of consumers report they are bothered by temporary inconveniences brought about by advanced security measures that help ensure higher levels of protection.
Consumer Behavior and Data Protection
Although many consumers consider extra cybersecurity precautions a hassle, they are taking some steps to protect themselves. According to the study, dodging inbound phishing attempts is a strong suit of consumers, but additional vigilance around password security is needed:
- The top measure consumers take to protect themselves is refusing to click email links or open attachments from people they don’t know, cited by 61% of consumers
- On the other hand, changing passwords is a cybersecurity step 42% of consumers take only if they are required to
- Of consumers surveyed, 33% have a go-to password they modify slightly to meet password requirements, and 20% use names of significant people, places or pets. Neither of these methods is considered a best practice.
Cybersecurity Awareness at Work
Consumers often look to their employer to provide cybersecurity training, but aren’t always getting the support they expect. Fifty-eight percent of consumers said their employer sends regular cybersecurity updates, and 45% said their employer offers formal cybersecurity training. Of consumers who aren’t provided cybersecurity training, only 9% said their employer has a plan in place to do so.
Employers have a vested interest in cybersecurity awareness, as educated employees can secure their own information and that of the business. Best practices for employers launching their own cybersecurity training include:
- Emphasize education at work – Ongoing education about new cybersecurity threats equips employees to recognize them and understand potential implications
- Encourage lockdown at home – Employees can secure their home networks, starting with changing all default passwords – especially for internet routers. Those with families can teach children about the dangers of cybercrime
- Keep information out of the public eye – Whether on personal or business computers, covering up screens when entering passwords and credentials in public areas helps keep information safe.
Additional Resources
About Fiserv
Fiserv, Inc. (FISV) aspires to move money and information in a way that moves the world. As a global leader in payments and financial technology, the company helps clients achieve best-in-class results through a commitment to innovation and excellence in areas including account processing and digital banking solutions; card issuer processing and network services; payments; e-commerce; merchant acquiring and processing; and the Clover® cloud-based point-of-sale solution. Fiserv is a member of the S&P 500® Index and the FORTUNE®500 and is among the FORTUNE Magazine World’s Most Admired Companies®. Visit fiserv.com and follow on social media for more information and the latest company news.
FISV-G
View source version on businesswire.com: https://www.businesswire.com/news/home/20191016005304/en/
The post #cyberfraud | #cybercriminals | American Consumers Recognize Their Role in Preventing Cybercrime, are Bothered by Perceived Inconveniences of Advanced Security appeared first on National Cyber Security.
View full post on National Cyber Security
When it comes to #cybersecurity, everyone leaves their #virtual door #open
How many of you have taken the two-factor authentication seriously and enabled it for your gmail account? Or for your social networking sites such as Facebook, Twitter and Instagram? Or for those websites that you have registered to shop online, pay utility bills or even book a cab? If you don’t remember doing it, it’s time to do it now.
According to a Google software engineer Grzegorz Milka, less than ten per cent of active gmail users – just one in ten people – are bothered to turn on two-factor authentication. This is a staggeringly low figure when one considers email accounts are the center of a digital web.
When people forget passwords for third-party services – such as social media, online shopping, and digital payment accounts – it is often their gmail account that serves as the recovery point. The fact that Google rolled out two-step authentication about seven years ago and yet the numbers are so low clearly explains that hardly anyone care to secure their social media platforms, which introduced this feature much later.
Your data is not just with banks or UIDAI or GSTN. Consumers store personal information on their smartphones putting themselves at risk in their day-to-day lives be it knowingly or unknowingly.
The post When it comes to #cybersecurity, everyone leaves their #virtual door #open appeared first on National Cyber Security Ventures.
View full post on National Cyber Security Ventures
Hackers could kill #patients by #attacking their #pacemakers, warns #Royal Academy of Engineering
Hackers could kill patients by attacking their pacemakers or heart pumps, the Royal Academy of Engineering has warned.
In a new report, security experts warned that health tech is vulnerable to cyberattacks which could have ‘severe consequences’ for patient safety.
The RAENG warned that the number of the number of healthcare devices which are susceptible to hacking is growing which not only poses a threat to individuals, but also provides a way to gain access to entire networks.
The experts cautioned that pacemakers or wearable health monitors which are linked up to the internet or internal computer networks could also provide a gateway for hackers to plant ransomware into systems, potentially crippling in the NHS or government departments.
Some US hospitals have already been infected by the Wannacry and Medjack computer viruses after hackers targeted medical devices which were not protected.
Professor Nick Jennings, a fellow of the RAENG and Vice Provost at Imperial College London said: “There is genuine harm that can be done through poor cyber security on medical devices, on future-connected homes, on autonomous vehicles, and if they are not dealt with then that will lead to harms and deaths.
The post Hackers could kill #patients by #attacking their #pacemakers, warns #Royal Academy of Engineering appeared first on National Cyber Security Ventures.
View full post on National Cyber Security Ventures
Why #Companies Need to #Focus on their #Cybersecurity for #Complete #Visibility
Source: National Cyber Security News
Digitization has taken over and how. But as every company makes a move to digital, it also opens up a plethora of dangers from the dark side of the Internet. Cybersecurity is a necessity has been reminded to us time and again in the past year with malware like Ransomware hitting the biggest companies across the world.
Tackling this growing threat and ensuring that companies are growing faster but safer is CTM360, a cybersecurity company based out of Bahrain. Entrepreneur India caught up with Vinod Johnson, Technical Accounts Manager, CTM360 on the sidelines of the Unbound Bahrain event, as he spoke about the need for companies to be vigilant and how Bahrain is the right place to start a company.
Managing Your Cyber Side
As a cybersecurity company, they offer cyber threat management services based on a subscription model. From digital risk management to detection and even response, Johnson said that they look at all sorts of cyber threats and take actions on the same.
Johnson admits that because of the growth of digitization, there’s so much stuff out there which is often missed by companies. “Companies don’t have a good visibility of their cyber assets.
View full post on National Cyber Security Ventures
While #Western Union #wired customers’ money, #hackers #transferred their #personal #deets
Source: National Cyber Security News
Western Union has confirmed one of its IT suppliers was hacked, and that customer information was exposed to miscreants.
A Register reader, who wished to remain anonymous, showed us a copy of a letter dated January 31 that he received from the money-transfer outfit. The missive admitted that a supposedly secure data storage company used by Western Union was compromised: a database full of the wire-transfer giant’s customer records was vulnerable to plundering, and hackers were quick to oblige.
“We have discovered that some of your information may have been accessed without authorization as a result of a computer intrusion against an external vendor system formerly used by Western Union for secure data storage,” the letter read.
“We promptly moved our external secure storage to a different vendor’s system. We immediately notified law enforcement, and are actively cooperating with its investigation. Expert assistance was also immediately engaged to determine what personal information may have been compromised.”
In other words, it sounds as though a cloud-based or off-site backup storage provider was hacked. Now that system has been shut down, the cops alerted, and digital forensics teams are probing the network intrusion.
Suspicious
“Upon detecting suspicious activity, Western Union permanently discontinued all use of the vendor’s system and the system was taken offline,” a spokesperson for Western Union told The Register today.
View full post on National Cyber Security Ventures
How #Parents Can Protect Their #Children From Infant #Identity Theft
Source: National Cyber Security – Produced By Gregory Evans
An identity thief can wreck credit scores, drain bank accounts, and cause underserved legal troubles. But the victims of identity theft aren’t always adults with established finances.
In fact, according to Robert Chappell Jr, the author of “Child Identity Theft: What Every Parent Needs to Know,” around 1.
The post How #Parents Can Protect Their #Children From Infant #Identity Theft appeared first on National Cyber Security Ventures.
View full post on National Cyber Security Ventures
How #seriously are #SMEs taking their #cyber security?
Source: National Cyber Security – Produced By Gregory Evans
Cyber security is essential for organisations of all sizes. Organisations need to ensure they have taken all the necessary precautions to protect their data.
In the past year, 46% of businesses identified at least one cyber attack or breach, with 875,000 of these victims being an SME. Despite these statistics, a recent survey found that many SMEs don’t believe they are at risk, with 59% thinking that their information would be of little value to cyber criminals.
This mindset is a major issue for small businesses because their lack of interest in cyber security makes them a favourable target for criminal hackers.
Why do criminals target SMEs?
Many small businesses do not put enough money and resources into cyber security. They do not monitor or implement strong enough cyber security defences that will adequately protect their data. Not having these defences in place makes their data more susceptible to attacks.
Although they may not feel that their information has much value to criminals, it very often does. Small businesses still hold personal and financial information, but they do not have the security defences in place that large organisations do. This makes them an easy and attractive target.
When an organisation has been hit by a ransomware attack, the criminals responsible will demand it pays a ransom to retrieve its data. It’s very difficult for small businesses to recover from ransomware attacks, so they are often more willing to pay the ransom than larger organisations would be. Again, this makes them an attractive target for many criminals.
How are SMEs being hacked?
The most common ways SMEs are hacked are by phishing, poor passwords and IT vulnerabilities.
Phishing schemes are fake emails that impersonate someone that you may trust: an online provider, bank, popular website or sometimes a colleague. These emails try to trick you into giving away sensitive information.
Passwords are vital for ensuring the security of your data. If a password is easy to guess or used for multiple platforms, it becomes less secure and easier to hack. Passwords should be unique and complex, and should never be shared..
IT vulnerabilities are a result of a network not having the right security measures in place in order to protect data. These vulnerabilities can lead to malware attacking an organisation’s data.
What precautions should SMEs take?
There are many simple ways an SME can protect itself from a cyber attack. Implementing a firewall is one of the first things an organisation should do, as this will put up a barrier between your data and the hacker, restricting their access.
It is very important to educate your employees to follow cyber security procedures. They should complete staff awareness training to ensure they can identify a phishing email, and follow basic security measures such as regularly changing passwords and adopting security policies.
Installing security software is vital to keep your data secure. Even after you have trained your staff, there is still the chance they may fall for a phishing email. Installing anti-malware software will help protect your organisation from malware that may be contained in these types of email.
Evaluate your cyber security posture
Gain a high-level evaluation of your organisation’s cyber security posture and a documented summary of recommendations for improvements with the Cyber Security Audit.
The post How #seriously are #SMEs taking their #cyber security? appeared first on National Cyber Security Ventures.
View full post on National Cyber Security Ventures
Fancy Bear #hackers are now #exploiting the #New York terror attack to #spread their #malware
Source: National Cyber Security – Produced By Gregory Evans
As the US justice department forges ahead with its investigation into the Trump administration and any possible collusion with Russia, the Fancy Bear hackers continue refining their attacks against global targets. As part of their new phishing campaign, the hackers are capitalising on the recent New York terror attack, to trick users into clicking on malicious documents, which in turn infects systems with their malware.
The Kremlin-linked hackers first made headlines during the 2016 US presidential campaign and are now widely considered to have orchestrated the cyberattacks against the US Democratic Party. The cyberespionage group has since been actively involved in various campaigns over the past year, targeting organisations and individuals across the globe.
The Fancy Bears’ most recent campaign, uncovered by security researchers at McAfee, involves the use of a black malicious document, titled “IsisAttackInNewYork”, which when clicked drops the hackers’ first-stage reconnaissance malware dropper Seduploader. The implant collects basic data from infected PCs and profiles prospective victims. Once hackers determine some interest in the victim, the implant then drops Fancy Bears’ customised malware X-Agent or Sedreco.
The post Fancy Bear #hackers are now #exploiting the #New York terror attack to #spread their #malware appeared first on National Cyber Security Ventures.
View full post on National Cyber Security Ventures
D5 Creation