Blog

Archive for Security Awareness Training

Major Global Crackdown on Email Compromise Schemes

Some cybercriminals operate a fraudulent scheme that is called a Business Email Compromise (BEC). In this crime, funds are stolen by convincing a person to send a bank wire to a dummy bank account for what the criminals claim is a legitimate transaction. Businesses that conduct operations that frequently make use of bank wires are the main targets for these criminals. Senior citizens and individuals may be targeted as well, especially if they are involved in a real estate transaction.

Under a program called “Operation Wire Wire,” federal law enforcement, with the cooperation of international authorities, were able to make a total of 74 arrests of alleged criminals. 42 were arrested in America, 29 arrests were made in Nigeria, and one arrest was made in each of the countries of Poland, Mauritius, and Canada. The law enforcement efforts in the United States were a coordinated investigation by the Department of Homeland Security, the Department of Justice, the Department of the Treasury and the U.S. Postal Inspector’s Office.

The investigation lasted six months. In addition to making the arrests, the investigation captured $2.4 million of stolen funds and authorities also blocked the illegal transfers of $14 million.

How does a business email compromise scheme work?

The BEC scheme is financial cybercrime. It is a sophisticated fraud that attacks employees with the authority to transfer company funds by bank wire. Businesses that work with foreign suppliers and those that regularly send bank wires are especially vulnerable. This fraud is usually achieved by obtaining the email account of a senior level employee for a company and impersonating this person to direct other employees to send a bank wire to the criminal’s account. Besides stealing money, the criminals may also try to obtain confidential information such as the employee tax records.

This fraud began in Nigeria. Now, through the involvement of transnational criminal groups, it spread across the globe. The use of Americans increased the success of this fraudulent scheme in the United States.

Conclusion

Companies continue to lose millions of dollars each year due to this scam. Consult with the security experts at Sentree Systems Corp. in Indianapolis, serving central Indiana and the surrounding cities of Avon, Carmel, Fishers, Noblesville, and Plainfield. They will help implement a more secure approval process for bank wire transfers, improve email security, and can create an ongoing employee education program to help employees spot criminal business email compromise attempts.

Share

Posted in: Newsletter Topics, Security Awareness Training

Leave a Comment (0) →

How to Know if Your Vendors Have Good IT Security

Many small- to medium-sized businesses rely on third-party vendors for some of the critical-path IT functions of a business. When they do this, the responsibility for maintaining IT security is transferred to the vendor. This may increase the risk of potential damage caused by security breaches.

There have been many examples of serious security breaches at vendors that have done major harm to their clients. This is why conducting detailed due diligence is necessary to identify the security risks of using a third party vendor’s services or software tools.

Comprehensive due diligence for security risk analysis focuses on the following areas and specifics:

  • Historical record of problems and how the vendor dealt with security issues.
  • Upgrade policy and rapid response with security patches for vulnerabilities.
  • Use of encryption to protect sensitive data.
  • Vendor’s ability to view, share, or sell data to other parties. Any transfer of data to other parties adds additional security risk.
  • Does the vendor have a dedicated security team?
  • Do they conduct regular security audits and are those reports available to clients?
  • Specific security protocols must be in place if there is a legal requirement for data protection. Examples of this include attorney-client privilege in the legal profession, strict privacy rules under HIPAA for healthcare records, and student information under COPPA and FERPA rules.

IT security risk is a serious issue. Businesses that are not experts in IT security issues benefit strongly by using a specialist consulting firm to help with the due diligence requirements in this area.

Sentree Systems Corp. gives data security advice for clients in Indiana serving the communities of Indianapolis, Avon, Plainfield, Carmel, Fishers, Noblesville and others. We recommend conducting a detailed review of the Service Level Agreement (SLA) from any vendor and a security audit to help identify security risks. It is much better to know in advance of the existence of potential security risks and take steps to mitigate them, rather than being blind-sided by sudden damage from a security breach that is not expected.

Share

Posted in: Monthly Security Brief, Security Awareness Training, Tech Tips for Business Owners

Leave a Comment (0) →

Scam Of The Week: Massive Netflix Phishing Campaign

There is a massive scam campaign going on, this time a very well executed Netflix phishing attack.

The scam targets subscribers telling them that their account is about to be canceled. The well-designed, individualized fake email convinces customers to update their account information to avoid suspension. This results in stolen personal and credit card information.

The email has the subject line “Your suspension notification” and includes a link where the subscriber is taken to a fake Netflix page which requires their log-in information as well as credit card number.

The scam was detected Sunday and it targeted nearly 110 million Netflix subscribers. As mentioned, the fake site includes Netflix’s logo as well as popular Netflix shows like “The Crown” and “House of Cards” to make it seem legitimate.

Share

Posted in: Monthly Security Brief, Newsletter Topics, Security Awareness Training, Tech News

Leave a Comment (0) →

New worldwide Ransomware outbreak “Bad Rabbit”

Organizations in Russia, Ukraine and the U.S. are under siege from Bad Rabbit, a new strain of Ransomware with similarities to NotPetya the last horrible outbreak.

The outbreak started Tuesday and froze computer systems in several European countries, and began spreading to the U.S., the latest in a series of attacks.bigstock-Manager-Pushing-Ransomware-Ons-116826572-

Department of Homeland Security’s Computer Emergency Readiness Team issued an alert saying it had received “multiple reports” of infections.
Russia’s Interfax news agency reported on Twitter that the outbreak shut down some of its servers, forcing Interfax to rely on its Facebook account to deliver news.

Bad Rabbit Starts With Social Engineering

The outbreak appears to have started via files on hacked Russian media websites, using the popular social engineering trick of pretending to be an Adobe Flash installer. The ransomware demands a payment of 0.05 bitcoin, or about $275, from its victim, though it isn’t clear whether paying the ransom unlocks a computer’s files. You have just 40 hours to pay.

Bad Rabbit shares some of the same code as the Petya virus that caused major disruptions to global corporations in June this year, said Liam O’Murchu, a researcher with the antivirus vendor Symantec Corp.

Based on analysis by ESET, Emsisoft, and Fox-IT, Bad Rabbit uses Mimikatz to extract credentials from the local computer’s memory, and along with a list of hard-coded credentials, it tries to access servers and workstations on the same network via SMB and WebDAV.

The hardcoded credentials are hidden inside the code and include predictable usernames such as root, guest and administrator, and passwords straight out of a worst passwords list. (Note To Self: all user passwords need to be strong, guide all employees through a strong password training module ASAP.)

As for Bad Rabbit, the ransomware is a so-called disk coder, similar to Petya and NotPetya. Bad Rabbit first encrypts files on the user’s computer and then replaces the MBR (Master Boot Record).

Ouch, that basically bricks the workstation!!!

Learn how to FIGHT Ransomware and stop being a victim!!!

 

 

 

Share

Posted in: Monthly Security Brief, Newsletter Topics, Security Awareness Training, Tech News

Leave a Comment (0) →

[ALERT] Don’t fall for the Equifax Scam

When news broke that the credit reporting agency Equifax had suffered a data breach, consumers around the country began to question the safety of their personal information.

After all, credit reporting agencies have access to most of your personal identifiable information (PII): name, address, birth date, Social Security number, and more.Finding out that the PII for more than 143 million US consumers had been stolen was upsetting, to say the least.

Now, consumers are being cautioned about what can happen with that information, and what steps they can take to protect themselves.

1. Beware of phishing attempts in “news” articles:

Immediately after the announcement of the data breach, articles began circulating that contained a link that lets you find out if your data was stolen. While Equifax has a dedicated web page that lets you enter your information and see if you’ve been exposed, it takes no work at all for scammers to create their own link, request your information for “verification” purposes, and then steal your data. Before clicking any links or entering any personal data, make sure you’re using a verified link that was issued by the correct source.

2. Emailed phishing attacks have already been reported:

There are already scam emails in circulation that suggest you check your credit report by using their handy link. The easiest way to verify an email’s sender is to hover your mouse over the sender’s name. The actual address used will appear in a small box. To be on the safe side, don’t click through from any emails you receive; if you’re told to check your credit report, use a verified request service or form instead of the emailed link.

3. Be on the lookout:

Because genuine information was stolen, be extra diligent about monitoring your account statements, looking for unauthorized charges, tracking and reporting any suspicious activity, and keeping a close eye on your credit reports. Never provide your sensitive information for verification purposes; if you receive a warning or alert, contact your financial institution directly using an approved contact method.

To visit Equifax’s verified link to discover if your information was stolen, go directly to Equifax’s website and follow the steps they suggest. If you do experience any strange activity on your accounts, report it immediately, no matter how minor it might seem at first. Be sure your antivirus software is up-to-date to block any malicious threats from fraudulent emails or messages, and consider placing fraud alerts and security/credit freezes on your credit report with the three reporting agencies if your information was accessed.

 

Read More Here @ITRC

 

Share

Posted in: Monthly Security Brief, Newsletter Topics, Security Awareness Training, Tech News

Leave a Comment (0) →

New Defray Ransomware Demands $5,000 In Customized Spear Phishing Attacks

This newly discovered ransomware strain is targeting healthcare, education, manufacturing and tech sectors in the US and UK, using customized spear phishing emails.defrayf1.png

Defray is demanding a relatively high ransom amount – $5,000 in Bitcoin, and ironically the word defray means “to provide money to pay a portion of a cost or expense.”

The Defray ransomware infection vector is spear-phishing emails with malicious Microsoft Word document attachments, and the campaigns are as small as just a few messages each. The planning and sophistication of the attacks point to a highly-organized cybercrime gang.

“The ransom note follows a recent trend of fairly high ransom demands; in this case, $5000. However, the actors do provide email addresses so that victims can potentially negotiate a smaller ransom or ask questions, and even go so far as to recommend BitMessage as an alternative for receiving more timely responses. At the same time, they also recommend that organizations maintain offline backups to prevent future infections,” Proofpoint researchers said in a blog.

The Proofpoint researchers, further said that the bad guys using this strain were using official logos of hospitals and businesses to trick users into opening malware-laced email attachments. In one of the campaigns, they designed the phishing emails as if they came from a UK-based aquarium with international locations.

“Defray Ransomware is somewhat unusual in its use in small, targeted attacks. Although we are beginning to see a trend of more frequent targeting in ransomware attacks, it still remains less common than large-scale “spray and pray” campaigns,” Proofpoint researchers said. “It is also likely that Defray is not for sale, either as a service or as a licensed application like many ransomware strains. Instead, it appears that Defray may be for the personal use of specific threat actors, making its continued distribution in small, targeted attacks more likely.”

 

See How Sentree Systems, Corp. can Help!!


Learn More!

 

Share

Posted in: Monthly Security Brief, Newsletter Topics, Security Awareness Training, Tech News

Leave a Comment (0) →

Scam Alert: Hurricane Harvey Charity Fraud

Hurricane Harvey hit hard and especially Houston, TX got badly flooded. The death toll is rising and you can also count on low-life cyber-scum exploiting this disaster. HurricaneHarvey.jpg

Disgusting.

Scammers are now using the Hurricane Harvey disaster to trick people in clicking on links, both on Facebook, Twitter and phishing emails trying to solicit charitable giving for the flood victims. Here are some examples:

  • Facebook pages dedicated to victim relief contain links to scam websites.
  • Tweets are going out with links to charitable websites soliciting donations, but in reality included spam links or links that lead to a malware infection.
  • Phishing emails dropping in a user’s inbox asking for donations to #HurricaneHarvey Relief Fund.

Previous disasters have been exploited like this, and the bad guys are going at it again will all guns blazing. Be wary of anything online covering the Hurricane Harvey disaster in the following weeks.

I suggest you send employees, friends and family an email about this Scam Of The Week, feel free to copy/paste/edit:

“Heads-up! Bad guys are exploiting the Hurricane Harvey disaster. There are fake Facebook pages, tweets are going out with fake charity websites, and phishing emails are sent out asking for donations to #HurricaneHarvey Relief Funds.

 

Don’t fall for any scams. If you want to make a donation, go to the website of the charity of your choice and make a donation. Type the address in your browser or use a bookmark. Do not click on any links in emails or text you might get. Whatever you see in the coming weeks about Hurricane Harvey disaster relief… THINK BEFORE YOU CLICK.

Share

Posted in: Monthly Security Brief, Newsletter Topics, Security Awareness Training, Tech News

Leave a Comment (0) →

IRS Issued Urgent Warning About An IRS & FBI- Ransomware

WASHINGTON, August 28, 2017 — The Internal Revenue Service warned people to avoid a new phishing scheme that impersonates the IRS and the FBI as part of a ransomware scam to take computer data hostage.

The IRS said: “The scam email uses the emblems of both the IRS and the Federal Bureau of Investigation. It tries to entice users to select a “here” link to download a fake FBI questionnaire. irs_questionnaire_safe.jpgInstead, the link downloads a certain type of malware called ransomware that prevents users from accessing data stored on their device unless they pay money to the scammers.”

“This is a new twist on an old scheme,” said IRS Commissioner John Koskinen. “People should stay vigilant against email scams that try to impersonate the IRS and other agencies that try to lure you into clicking a link or opening an attachment. People with a tax issue won’t get their first contact from the IRS with a threatening email or phone call.”

I suggest you send employees, friends and family an email about this ransomware attack, feel free to copy/paste/edit:

“Heads-up! The IRS is warning against a new phishing scam that tries to make you download an FBI questionnaire. But if you click the link, your computer will be infected with ransomware instead. The scam email uses the emblems of both the IRS and the Federal Bureau of Investigation.

 

Remember that the IRS does not use email, text messages or social media to discuss personal tax issues, such as those involving bills or refunds. THINK BEFORE YOU CLICK!

The IRS stated: “Victims should not pay a ransom. Paying it further encourages the criminals, and frequently the scammers won’t provide the decryption key even after a ransom is paid. Victims should immediately report any ransomware attempt or attack to the FBI at the Internet Crime Complaint Center, www.IC3.gov. Forward any IRS-themed scams to phishing@irs.gov.”

Here is the official IRS Newsroom post : https://www.irs.gov/uac/newsroom/irs-issues-urgent-warning-to-beware-irs-fbi-themed-ransomware-scam

Share

Posted in: Monthly Security Brief, Newsletter Topics, Security Awareness Training, Tech News

Leave a Comment (0) →

Facebook and Google Were Victims of 100 Million-Dollar Phishing Scam

We have been reporting on this massive Cyberheist for a while now, but Fortune Magazine decided to unleash their investigative reporters and find out exactly who those two mysterious high-tech companies were that got snookered for a whopping 100 million dollars. 

It is excellent ammo to send to C-level executives to illustrate the urgent need to train employees so they can recognize red flags related to spear phishing.scam-troll-796x531.jpg

Here is how the Fortune story starts:

“When the Justice Department announced the arrest last month of a man who allegedly swindled more than $100 million from two U.S. tech giants, the news came wrapped in a mystery. The agency didn’t say who was robbed, and nor did it identify the Asian supplier the crook impersonated to pull off the scheme.

The mystery is now unraveled. A Fortune investigation, which involved interviews with sources close to law enforcement and other figures, has unearthed the identities of the three unnamed companies plus other details of the case.

The criminal case shows how scams involving email phishing and fake suppliers can victimize even the most sophisticated, tech-savvy corporations. But the crime also raises questions about why the companies have so far kept 
silent and whether—as a former head of the Securities and Exchange Commission observes—it triggers an obligation to tell investors about what happened.

The Masssive Phishing Heist

In 2013, a 40-something Lithuanian named Evaldas Rimasauskas allegedly hatched an elaborate scheme to defraud U.S. tech companies. According to the Justice Department, he forged email addresses, invoices, and corporate stamps in 
order to impersonate a large Asian-based manufacturer with whom the tech firms regularly did business. The point was to trick companies into paying for computer supplies.

The scheme worked. Over a two-year span, the corporate imposter convinced accounting departments at the two tech companies to make transfers worth tens of millions of dollars. By the time the firms figured out what was going on, Rimasauskas had coaxed out over $100 million in payments, which he promptly stashed in bank accounts across Eastern Europe.”  

 

Learn how to FIGHT Ransomware and stop being a victim!!!

 

 

Share

Posted in: Monthly Security Brief, Newsletter Topics, Security Awareness Training, Tech News

Leave a Comment (0) →

[ALERT] A New Worldwide Ransomware Outbreak Petya

Motherboard reported: “A quickly-spreading, world-wide ransomware outbreak has reportedly hit targets in Spain, France, Ukraine, Russia, and other countries.

 

Motherboard continued: “The attacks are similar to the recent WannaCry outbreak, and motherboard has seen several reports of infections shared by victims on Twitter. We were not able to immediately confirm the veracity of the reports, but several security researchers and firms also reported the attacks.New Ransomware Attack

“We are seeing several thousands of infection attempts at the moment, comparable in size to Wannacry’s first hours,” Costin Raiu, a security researcher at Kaspersky Lab, told Motherboard in an online chat.

Judging by photos posted to Twitter and images provided by sources, many of the alleged attacks involved a piece of ransomware that displays red text on a black background, and demands $300 worth of bitcoin.

“If you see this text, then your files are no longer accessible, because they are encrypted,” the text reads, according to one of the photos. “Perhaps you are busy looking for a way to recover your files, but don’t waste your time. Nobody can recover your files without our decryption service.”

Raiu believes the ransomware strain is known as Petya or Petrwrap, a highly sophisticated Russian strain, without all the errors that WannaCry contained, and no kill-switch. According to a tweet from anti-virus company Avira, the Petya attacks were taking advantage of the EternalBlue exploit previously leaked by the group known as The Shadow Brokers

EternalBlue is the same exploit used in the WannaCry attacks; it takes advantage of a vulnerability in the SMB data-transfer protocol, and Microsoft has since patched the issue. However, whether customers apply that patch is another matter.

Security researchers from Kaspersky Lab reported that the ransomware hit Russia, Ukraine, Spain, France, among others. Several people on Twitter reported witnessing or hearing reports of the outbreak in their respective countries, and across a wide range of industries. Companies around the world also reported computer outages.

If You Have Not Done So Yet, Apply This Patch Immediately.

From what we have been able to learn, this new worm spreads through SMB jkust like WannaCry so when we’re talking about machines behind firewalls being impacted, it implies port 445 being open and at-risk hosts listening to inbound connections. It’d only take one machine behind the firewall to become infected to then put all other workstations and servers at risk due to it being a true worm.

In the meantime, harden yourselves against this Windows Network Share vulnerability and ensure that all systems are fully patched with the “MS17-010” security update (link below) and remind all staff to Think Before They Click when they receive any out of the ordinary emails. https://technet.microsoft.com/en-us/library/security/ms17-010.aspx

Note, the patch is included in the Monthly Quality rollups. Also, block inbound connections on TCP Port 445

[UPDATE 6/27/2017] 1:40pm

“It is definitely using EternalBlue to spread,” says Fabian Wosar, a security researcher at the defense firm Emsisoft, which specializes in malware and ransomware. “I confirm, this is a WannaCry situation,” Matthieu Suiche, the founder of security firm Comae Technologies, wrote on Twitter.

Group-IB believes the attacks on Ukraine and Rosneft were simultaneous and coordinated. Kaspersky and Flashpoint think they’re observing signs of the Petya (a.k.a. Petrwrap) strain of ransomware in the attacks.

Other major infestations are reported by the Danish shipping concern A.P. Moller-Maersk, pharmaceutical company Merck (this in the US), Deutsche Post (its operations in Ukraine), and British ad agency WPP. More are sure to come.

The ransom note’s text has appeared in English, but Ukrainian authorities blame Russian hackers, especially since the attack coincides with tomorrow’s observance in Ukraine of Constitution Day. On this interpretation the attack’s spread is due either to the inherently difficult-to-control nature of malware, deliberate misdirection, or willingness to take such targets of opportunity as present themselves.

UPDATE 6/27/2017 2:13pm

Delivery/Exploitation

We have not yet confirmed the initial infection vector for this new Petya variant. Previous variants were spread through e-mail, but we have not identified this latest sample carried in any e-mail related attacks.

Installation

This variant of Petya is spread as a DLL file, which must be executed by another process before it takes action on the system. Once executed, it overwrites the Master Boot Record and creates a scheduled task to reboot the system. Once the system reboots, the malware displays a ransom note which demands a payment of $300 in bitcoin.

Command and Control

Petya contains no Command and Control mechanisms that we know of. After a host is infected, there is no communication from the malware back to the attacker.

Lateral Movement

Petya may spread to other hosts directly using SMB or through the ETERNALBLUE exploitation tool.

 

Learn how to FIGHT Ransomware and stop being a victim!!!

 

 

Share

Posted in: Monthly Security Brief, Newsletter Topics, Security Awareness Training, Tech News

Leave a Comment (0) →
Page 1 of 4 1234
Real Time Web Analytics