Greg's Corner

Tagged: cybersecurity Toggle Comment Threads | Keyboard Shortcuts

• 

  Geebo 9:00 am on November 18, 2019 Permalink | Reply
  Tags: cybersecurity, Disney+, hacking ( 31 ), malware ( 26 ), passwords ( 5 ), streaming ( 9 )   

  Disney+ accounts are under attack 

  

  Disney+ is the home streaming service brought to you by the Walt Disney Company. It just recently launched and is already seen as a competitor to Netflix. It was hugely successful upon its recent launch and it’s easy to understand why. Not only do they provide the famous Disney catalog but they also own many other entertainment properties such as the Marvel movies and former Fox-owned shows like The Simpsons. That’s not even taking the entire Star Wars franchise into account along with the new Star Wars ongoing series The Mandalorian. Of course, where there’s an online success there are people looking to take advantage of that success and Disney+ is no different.

  Within hours of the launch of Disney+, users were already complaining that they had been locked out of their accounts. These compromised accounts are now up for sale on some of the seedier parts of the web. The accounts are going for as little as $3-$11. Many of these accounts were paid for years in advance leaving those affected with little to no recourse. Basically, hackers were gaining access to the accounts with previously compromised email and password combinations. The hackers then change the login information, locking the account’s owner out before putting the account up for sale.

  If you have a Disney+ account and you’re using a password that you’ve used elsewhere, change your password right away. In general, you should never use the same password twice. As always, we recommend using one of the many free password managers out there. If you were thinking about enabling two-factor authentication on your Disney+ account, unfortunately, you can’t. Disney has yet to offer that feature on Dinsey+. You may also want to do a malware scan on your computer as that’s another popular way that scammers and hackers can obtain your passwords.

  You should be enjoying this service and not having to spend hours with customer service trying to get the issue resolved even if you can.

   

  Leave a ReplyCancel reply
• 

  Geebo 9:00 am on November 8, 2019 Permalink | Reply
  Tags: Amazon ( 108 ), cybersecurity, internet of things/ ( 7 ), IoT ( 7 ), Ring Doorbells ( 3 ), security ( 46 )   

  Is your Ring doorbell at risk of attack? 

  

  Ring Doorbells have become very popular over the past few years. Not only does it offer the convenience of knowing who’s at your door while you’re not home, but it also records any interaction that occurs at your front door. With the assistance of Ring Doorbells, all sorts of interlopers have been caught ranging from porch pirates to home intruders. They’ve become so popular and ubiquitous that police stations around the country are recommending residents install one and become part of a police network of cameras. So, it should come as no surprise that bad actors may want access to your camera.

  [youtube https://www.youtube.com/watch?v=Bf3wLc0giZI%5D

  Amazon, owners of Ring, recently announced that there was a vulnerability in Ring Doorbells that could have exposed your wifi password to attackers. During the authentication process, the communication between your doorbell and the was unencrypted leaving your wifi password open in plain text and potentially available to hackers. While any attack wouldn’t be able to control the camera itself, once your home wifi is vulnerable an attacker could compromise any number of systems especially if you have a number of smart home or internet of things (IoT) devices.

  Thankfully, Amazon patched this vulnerability before they made it public knowledge. That’s not even taking into account that any attack against the doorbell would have to happen at the precise moment of authentication and the attacker would need to be in range of your home wifi. The chances of a hacker being on your property at the time of authentication are very slim. However, this does show that no smart home or internet-enabled security device is foolproof. When purchasing such a device, do your research in finding out which ones are the most secure and which ones receive regular updates from the manufacturer. Otherwise, you could be as secure as leaving your front door unlocked.

   
• 

  Geebo 9:00 am on November 5, 2019 Permalink | Reply
  Tags: cybersecurity, Facebook ( 178 ), hacking ( 31 ), Online ads ( 3 )   

  Are hackers spending your money on Facebook? 

  

  Business owners, whether they may be big or small, often take out ads on Facebook. Considering Facebook’s massive reach, placing ads on Facebook is almost considered a no-brainer. In order for businesses to place these ads, they need to enter some kind of payment information on Facebook. That can be either a credit or debit card or some kind of online payment like PayPal. You don’t even have to be a business to place a Facebook ad as anybody can purchase an ad. Now, some hacked Facebook accounts have led to these ads being purchased without the knowledge of the account’s owner.

  CNET is reporting that they’ve received reports of hacked Facebook accounts being used to purchase questionable ads. The ads are then charged to the account of whoever’s account has been compromised while the hackers get their ads served for free. The ads tend to be for some kind of scam product where the hackers are just looking to gain the financial information of more victims. You don’t even have to have a Facebook business account for this to happen. If you’ve ever entered your payment information to Facebook for whatever reason, you could be in jeopardy if your account becomes compromised.

  [youtube https://youtu.be/726i18ZXAi4?t=290%5D

  To better protect yourself against an attack like this is to have a secure password used specifically for your Facebook account. Never use similar passwords for different accounts. While business accounts have to keep an eye out for fraudulent charges, personal accounts can remove their payment information from Facebook. On your Facebook account, click on the settings option then scroll down to the payment information option. Once you click on that you’ll have the option to remove your payment information.

   
• 

  Geebo 8:04 am on October 21, 2019 Permalink | Reply
  Tags: 2FA ( 11 ), cybersecurity, internet of things/ ( 7 ), IoT ( 7 ), security ( 46 ), Smart Home ( 5 ), two factor authentication ( 17 )   

  Smart home camera hacked in baby’s room 

  

  A California CEO has written a column for The Mercury News where he relays the tale about how his smart home camera system was hacked. It is quite a rather harrowing tale as the digital vandals used the speaker on the camera in the baby’s room to harass the family’s nanny. The anonymous voice on the other end of the camera was using profanity and even threatened to come take the baby at one point. It wasn’t until all the cameras were disconnected did the harassment stop. The father later found out that this is a fairly common occurrence with internet-connected cameras, specifically the brand that he was using.

  The father then tried contacting the technical support arm of the corporation that manufactures the cameras and was on hold for over an hour. He also received emails that continued to push the idea of two-factor authentication to keep out would-be pranksters. The father was not satisfied with this response and has vowed not to use this brand of camera ever again. His outrage can be understood especially for parents with young children because you can never truly know who is watching your home while you’re unaware. A more sophisticated criminal could use such information gleaned from home cameras to tell when a home may be vulnerable to being robbed.

  [youtube https://www.youtube.com/watch?v=Tgfg4Dv2B2M%5D

  While the camera maker’s customer service may sound a little tone-deaf as far as the father’s mistrust is concerned, their advice about two-factor authentication is not wrong. 2FA, as it’s known, can go a long way in preventing these cameras from being hijacked. Also if you use the same password across multiple services you could be compromising your security greatly by making it easy for hackers to gain access to your devices. In this case, you may want to try some of the more reliable password managers out there. As we have said before, if you don’t take your internet security more seriously, it’s like having the most expensive lock that you just leave the key in.

   
• 

  Geebo 8:00 am on October 15, 2019 Permalink | Reply
  Tags: cybersecurity, phone security ( 6 ), privacy ( 46 ), security ( 46 ), sim jacking ( 3 ), sim swapping ( 8 ), smart phones ( 13 )   

  SIM Swapping can cost you thousands if you’re not careful 

  

  Freelance British food writer Jack Monroe recently made news when she found out that someone stole the phone number to her smartphone. They were then able to transfer the number to another phone where they had access to some of her financial information and were able to steal £5,000 from her personal account. That amount equates to close to $6,300 in the U.S. This is a trick known as SIM_Swapping or SIM-Jacking named after the SIM cards in most smartphones that contain your calling information including your phone number. Unfortunately, there’s not a lot you can do to protect yourself against the attack.

  SIM Swapping works when the victim is targeted by someone with knowledge of how the attack works. First, they get your name, address, and date of birth, then they contact your cell phone carrier to try and convince them that they are you. If the attacker is successful, he can get the carrier to switch your number to their phone. The attacker can then receive all your calls, texts, emails and the like. That way they can receive the two-factor authentication texts that would allow them to access any of your sensitive online accounts including banking.

  [youtube https://www.youtube.com/watch?v=6occS3PyOss%5D

  While most victims of SIM Swapping don’t notice the attack until it’s too late, there are some steps you can take to try to protect yourself although nothing is a guarantee of preventing such an attack. You can instruct your cell phone carrier to require a PIN number if anyone calls to try and have any portion of your service changed. As with most PINs, don’t make it something obvious that an attacker can guess like your birthdate. You can also sign up for a Google Voice number which is much more secure and tougher to attack than a traditional cell phone number but work just like a traditional phone number and they are also free to get.

   
• 

  Geebo 8:00 am on October 9, 2019 Permalink | Reply
  Tags: 2FA ( 11 ), advertising ( 11 ), cybersecurity, phone security ( 6 ), security ( 46 ), Twitter ( 13 ), two factor authentication ( 17 )   

  Twitter leaks phone numbers to advertisers 

  

  We’ve mentioned two-factor authentication, or 2FA as it’s known, a few times lately. It’s the security protocol that has two or more layers of authentication that better secures your online accounts. The most common form of 2FA is through text messaging. For example, if you have 2FA enabled, when you sign in to an online account not only would you have to provide your password but you’d also have to provide a code that had been texted to you. While authentication sent through SMS texts isn’t the most secure form of 2FA it is better than nothing. However, thanks to so many platforms using SMS texting for 2FA it has led one platform to issue an apology recently.

  [youtube https://www.youtube.com/watch?v=07mRDyydCNY%5D

  Twitter recently announced phone numbers that users had registered with them for two-factor authentication were used for targeted advertising. The numbers were used to match users to marketing lists provided by advertisers. In some people’s eyes, that goes against everything that 2FA is supposed to stand for. One security expert even compared Twitter’s practice to that of trying to secure a tent against bears by using raw meat.

  Like we said, While SMS text messages are the most common form of 2FA, they’re not the most secure. There are alternatives that you can use that are more secure. There are hardware keys that act as authenticators that can be used on both computers and mobile devices. There are also software alternatives that are free, that create something along the lines of a temporary secondary password that can be used for the second layer of authentication. This way, you won’t have to worry about even more robocalls from advertisers and other bad actors from plaguing your phone.

   
• 

  Geebo 8:00 am on October 3, 2019 Permalink | Reply
  Tags: cybersecurity, formjacking, security ( 46 )   

  New online attack is undetectable! 

  

  With most online threats there is a lot that consumers can do to protect themselves. For example, with phishing attacks, you can go to a website directly rather than using the link provided in an email or text. To avoid malware you can avoid risky websites and install an anti-malware program in case you do get infected. However, security experts are now warning about an online threat that has virtually no protection. It’s called formjacking and there’s no way to detect it until it’s too late.

  Formjacking is when a third-party injects code into a secure website that uses forms for anything from a job application to payment methods. If a website has been compromised then the attackers can lift any information submitted through the form. As you can imagine, this can include your home address, your social security number, and any credit or debit card numbers. The only defense against formjacking is for the company that owns the website to do a constant review of the site’s code to make sure there is no malicious code in there.

  [youtube https://www.youtube.com/watch?v=zeRxFynfvLE%5D

  Not all hope is lost though. There are services that can provide you with temporary charge card numbers that can be assigned to individual services that you may use. Your bank or credit card provider may also offer such a service. Both Google and Apple Pay are reportedly said to be secure as well. But we fill out so many forms online there isn’t anything that can guarantee 100% protection. Your best defense is to keep a watchful eye on your charge statements and credit history to make sure that no one has lifted your information and used it for their gain.