The phish attack obtained banking details Three Wichita State University employees fell prey to a common phish attack asking for their credentials, giving cybercriminals access to change banking details. We’ve said it time and time again: the cybercriminals do their homework. In the case of the attack on WSU employees, cybercriminals spoofed the university’s payroll system and sent emails to employees tricking them into providing their university ID and password. That was all the attackers needed to gain full control to the employee’s profile, personal data, and most importantly – banking information. Where's my paycheck? It wasn’t until a number of employees did not receive their paychecks that the scam was found out. At least three members of the WSU staff fell for the scam, allowing cybercriminals to alter the ... Read More

Cybersecurity starts with your users Your cybersecurity trained employees are a central component of your security posture, according to Freaky Clown (FC), CEO and Head of Ethical Security at Cygenta. FC is a professional red teamer who tests the security of organizations by breaking into them. FC talked to Carole Theriault in part two of an interview on the CyberWire’s Hacking Humans podcast. FC says that managers are often surprised by how far he can get without being caught, because employees don’t know to watch out for threats. He describes a number of unusual situations in which he has convinced employees to participate in strange activities, such as building teepees with their coats as a team building exercise, or setting up a bar in a government building. “You can ... Read More

Passwords get stolen and sold The bad guys are constantly coming out with new ways to hack into your network and steal your organization’s confidential information. Verizon's recent Data Breach Report showed that 81% of hacking-related breaches used either stolen or weak passwords. And, a new survey from Dark Reading shows 44% of organizations say users pose the greatest threat to data security! Find out if your users are putting a big target on your organization’s back KnowBe4’s Password Exposure Test (PET) is a new and complimentary IT security tool that allows you to run an in-depth analysis of your organization’s hidden exposure risk associated with your users. PET makes it easy for you to identify users with exposed emails publicly available on the web, and checks your Active Directory to see if they are using weak or compromised ... Read More

AI and facial recognition are dangerous As I proofread this post, Facebook users are jumping on a new fad. They are posting pictures of themselves 10 years ago and today. They do this to show much they have aged, or have not aged, in 10 years. I think this is dangerous. AI can take these facial images, superimpose your face on an image and then defraud you. This starts to be more than a bit concerning. The faces in this post (below) look like pretty normal humans. They could be social media shots. However, they were generated by a recent type of algorithm: generative adversarial network, or GAN. Nvidia researchers Tero Karras, Samuli Laine, and Timo Aila posted details of the method to produce completely imaginary fake faces with ... Read More

2FA can be beaten A new phishing attack method shows that even the mighty Two-Factor Authentication (2FA) can be beaten without needing to possess a user’s mobile device. We’d like to think that using 2FA surrounds the logon process with such a high level of security that it can’t be broken. But a recent phishing attack shows that simple mix of social engineering and quick backend hacking can successfully work around the most basic of 2FA – two-factor, SMS one-time password (OTP) authentication. Researchers at Certfa Labs recently identified the attack scheme created by the cybercriminal group Charming Kitten (who hacked HBO back in 2017). The phishing attack uses the Google’s Site Service (which uses the subdomain sites.google.com) to establish credibility and to deceive their potential victims. Fake notices to Google users Users are initially ... Read More

12 Ways to Hack MFA Special thank you to Author Roger Grimes, KnowBe4's Data-driven Defense Evangelist.   It was a standing room-only crowd when I gave it at Blackhat USA in Las Vegas this year, and I’m giving it again at this coming year’s RSA. If you’re interested in seeing it before then, do an Internet search on ’12 Ways to Hack 2FA Grimes’ and you are sure to get lots of opportunities to view one of the many previous presentations. It seems to have hit a digital nerve with computer defenders and end-users alike. I think the reason it is so interesting is that it is surprising to many people that multi-factor authentication (MFA) does not protect you from hackers (including simple phishing) as much as you would ... Read More

Phishing campaign tricks financial industry employees Researchers at Menlo Labs have spotted a new phishing campaign aimed at tricking employees of US banks and financial firms into downloading Houdini Malware. It’s no surprise that cybercriminals are going where the money is – in this case, literally. A phishing campaign that has been running since August has been identified seeking to compromise business endpoints using a combinations of tactics: Reputation Jacking – all of the files were hosted on Google’s Cloud Storage (storage.googleapis.com). This use of well-known, popular hosting services helps to avoid detection. (According to Menlo Lab’s most recent Annual State of the Web Report, 4,600 phishing sites used legitimate hosting services. Archived Files – the files linked to in these campaigns were zip or gz archive files, further obfuscating the malicious payload. ... Read More

Phishing and file sharing are Wall of Shame bait Internet thieves have long used file sharing sites and services to host their malicious files. When they do this, they typically use the underlying service to generate download links that anyone can click without logging in to the hosting service. Makes sense when you're blasting out thousands upon thousands phishing emails with malicious links. You want to set the table for a feast, not an intimate dinner for two. The other thing the bad guys typically do, however, is generate their own emails instead of using the underlying hosting service to deliver their malicious links to a wide audience. Doing so reduces the chances that the service notices something is amiss (like mass spam deluges erupting from their own servers) ... Read More

Criminal gangs are behind CEO fraud A new study by Agari concludes that, despite all the finger pointing and attention some countries' services have been getting for their phishing attacks, the big threat still comes from criminal gangs. Here is your quick Executive Summary: 97% of people who answer a CEO Fraud email become victims The average CEO fraud incident included a payment request of $35,500 (ranging from $1,500 to $201,805) 24% of all observed email scam attempts between 2011 and 2018 were CEO fraud even though CEO fraud only started in earnest in 2016 And what's that country? Many of those criminal gangs continue to operate from Nigeria, of the ten gangs engaged in the email scams that Agari studied, nine were based in Nigeria. Conclusion: the old Nigerian 419 ... Read More