CEO Fraud Scam costs firm $6 million
Knowbe4 and CNBC reported some pretty stunning breaking news. I cannot come up with a better case for new-school security awareness training for employees in accounting and HR.
A lawsuit filed on Friday September 16, 2016 by Tillage Commodities Fund alleges that $6 billion SS&C Technologies Holdings, a financial services software firm, showed an egregious lack of diligence and care, when they fell for a CEO fraud scam that ultimately led to hackers in China looting $5.9 million.
Tillage claims that SS&C didn't follow their own policies, which enabled the theft, but to add insult to injury, staffers actually helped the criminals by fixing transfer orders that had initially failed. The documents were posted online by the law firm representing Tillage in the case. Above is the stock price on Monday, before ... Read More
FOR IMMEDIATE RELEASE. CAMERON PARK, CA (November 12, 2020) – Cyber Safety Net today announced How Hacks Happen and how to protect yourself was awarded the Nonfiction Authors Association's Gold Award.
"The Nonfiction Authors Association sets the bar extremely high," says author Mark Anthony Germanos. "To have How Hacks Happen be reviewed by other authors and receive the Gold Award is truly an honor. I am glad the reviewers, and reading public as a whole, are finding How Hacks Happen valuable. The content helps keep you safe online." Some sample reviews are as follows:
In How Hacks Happen, Mark Anthony Germanos uses two author personas to explain and illustrate the hazards to our online information: the cybersecurity expert trying to help us and the black-hat hacker exploiting our ... Read More
Free email services monetize your personal information. Use one of them and you are vulnerable. Free email and social media services are indexing and monetizing your mailbox data. They use that information for their gain, not yours.
Gmail monetizes your personal informationFor example, https://policies.google.com/terms?hl=en says “When you upload, submit, store, send or receive content to or through our Services, you give Google (and those we work with) a worldwide license to use, host, store, reproduce, modify, create derivative works (such as those resulting from translations, adaptations or other changes we make so that your content works better with our Services), communicate, publish, publicly perform, publicly display and distribute such content. The rights you grant in this license are for the limited ... Read More
Google tracks you (but you can purge what they know)
Two days ago, I wrote about how Google tracks you. Please see https://wp.me/paAiP4-wh for a refresher.
Go to the Google Dashboard at https://myaccount.google.com/dashboard. Let’s just download this data. Click the Download your data link, which takes you to https://takeout.google.com. Scroll through this list of services Google thinks you use. Google checks all by default. At the bottom, click the Next step button.
I am choosing to export this data once, save the data as a .ZIP file and span my data across multiple .ZIP files when the files are larger than 2 GB. Click the Create export button.
Google reports “This process can take a long time (possibly hours or days) to complete. You'll receive an email when your ... Read More
Google tracks your activity
They've been tracking you since you first created that free Drive, Gmail or YouTube account. You can review the data Google tracks and download it. Google also lets you delete some data.
Google tracks via Gmail
Take a deep breath and visit https://myaccount.google.com/dashboard. Login if prompted.
Let’s start with the Gmail link. Google indexes Gmail contents and uses that to help determine which ads will be most interesting to us. Let’s see just how much data Google tracks.
Click the Gmail button.
Click GO TO GMAIL.
Click All Mail (on the left).
Peruse your entire mailbox.
Google reports 4,789 messages in my Gmail account. Although Google reports 4,789 messages, I see only 224 messages in my Inbox, 10 in Trash and 487 in Sent. The rest ... Read More
Remote Desktop is a big vulnerability
Maybe you use Microsoft’s Remote Desktop feature to connect to your workstation at work from…anywhere. Remote Desktop has been in Windows for 20 years at no extra cost. The network administrator at my target reviews the workstation’s logs through Windows’ Event Viewer. This screenshot is from my research honeypot.
Someone is trying to login to this virtual machine at a ferocious pace
The unlucky soul who has to read these logs finds login attempts are international. My perusal shows login attempts from five IP addresses:
211.72.1.31 in Taipei, Taiwan
24.142.48.215 in Dartmouth, Canada
87.147.195.55 in Olching, Germany
47.185.77.29 in Keller, Texas
91.234.125.163 is in Sosnicowice, Poland
Assuming it is one hacker who either employed a botnet (a series of computers simultaneously tasked with a large task) or is ... Read More
Let LastPass manage your passwords (you have other things to think about today).
We have too many passwords. Keeping track of them mentally or on Post-It notes does not work. Keeping them in a Microsoft Word document is also troublesome. If you change a password and fail to update the document, then the record becomes wrong. Next time you go to that website and use the password in your Microsoft Word document, it won’t work. You did not update the document. Let me introduce LastPass.
Several companies have solutions. I use LastPass, which lets you create a vault that holds all your passwords. You don’t have to remember what LastPass stores in the vault. You only have to remember the master password to access the vault. The ... Read More
2-factor Authentication helps protect your identity.
You should deploy 2-factor Authentication. This increases your security and reduces your chances of becoming an identity theft victim. Most services encourage 2-factor Authentication and let you deploy it at no additional cost.
Here's a quick question for you.
When attempting to access a website, the website can challenge you based on:
A) What you know (e.g. password).
B) Who you are (e.g. fingerprints).
C) What you have (e.g. phone).
D) All of the above.
Correct answer: D.
How it looks in real life.
Daisy runs a dental office in Folsom, CA. Keeping the practice up and running is her top priority. She runs most of her patient, insurance and vendor communications through her Gmail account. She deploys 2-factor Authentication with the steps at https://myaccount.google.com/signinoptions/two-step-verification/enroll-welcome. She keeps her smartphone nearby. ... Read More
Did you know your multifunction printer has its own backdoor WIFI?
Allen called me one day and said his printer was printing nonstop garbage. He wasn’t printing anything, but somebody was printing through WIFI. This print job was consuming his toner and paper. How did this happen?
I told Allen that in addition to joining your multi function printer to your office or home WIFI, you’ll find the printer broadcasts its own WIFI signal. You, or anybody close enough to the printer, can hop on that printer through that WIFI. A hacker could then cause mischief, including changing the printer’s IP addresses or printing large print jobs that consume paper and toner. I am showing you how to identify your printer’s WIFI, and how to secure it.
Assumptions
... Read More
Triton got into a petrochemical plant
In the summer of 2017, a petrochemical plant in Saudi Arabia experienced a worrisome security incident that cybersecurity experts consider to be the first-ever cyber attack carried out with “a blatant, flat-out intent to hurt people.” The attack involved a highly sophisticated new malware strain called Triton, which was capable of remotely disabling safety systems inside the plant with potentially catastrophic consequences. It all started when someone launched a spear phishing attack and someone else clicked a link they should not have clicked.
Luckily, a flaw in the Triton code triggered a safety system that responded by shutting down the plant. If it hadn’t been for that flaw, the hackers could have released toxic hydrogen sulfide gas or caused explosions. As ... Read More