Oktacron - Cyber Security RSS Feeds History

What to do if your home Wi-Fi is slow | Kaspersky official blog

kaspersky Mar 17, 2021 Tips

Online games lag, the picture freezes during a job interview, and video streaming’s out of the question: It might be that your router can’t handle the load, but consider the neighbors as well. Are they surfing on your dime? Find uninvited guests To find out if broadband squatters are stealing your show more ...

bandwidth, you need to check the list of devices connected to your network. Your router’s administration pages will show you that list, but unfortunately, not all manufacturers prioritize user-friendliness, and the list can be difficult to understand. An alternative option is to use Kaspersky Security Cloud‘s simple and straightforward home network map. Here’s how: In the router settings or Kaspersky Security Cloud, open the list of connected devices and check it carefully. If you see an unfamiliar name next to the expected household members’ phones and laptops, plus any smart appliances you own, someone else is probably using your connection. That’s not nice, of course, but surely it isn’t dangerous — right? Well, it is. Your neighbor might think they’re just downloading WandaVision but accidentally grab some malware as well, which will then attack your devices over the Wi-Fi you’re unwittingly sharing. In fact, a Trojan can give attackers access to every bit of data you send over the Internet: credit card numbers, confidential work documents, and so forth. Even if you don’t mind a slower connection, you should probably kick squatters off your home network, and make sure they can’t come back. Block unauthorized Wi-Fi access Change your passwords. Passwords are still your first line of defense, so if for some reason you haven’t already, set a password for your Wi-Fi network. If you did, but outsiders are still connecting, change the password to guard against brute-force access. Make the password strong! Yes, every connected device will have to reconnect, but you shouldn’t have to enter that stronger password more than once per device. At the same time, change your router’s admin panel username and password. Remember that factory settings are not unique — often the same combinations, such as admin/admin or admin/password, unlock any of the thousands of units of the same model. They’re very easy to find, posted online, and essentially an open invitation to hackers. Disable WPS. Using WPS (Wi-Fi protected setup) simplifies the authorization process. Whereas setting up a wireless home network used to require at least a bit of tech savvy, routers now have WPS so users can simply press, click, or tap a button on the router, or enter an 8-digit PIN, to connect. The short PIN is extremely vulnerable to brute-force attacks, however, and entering it doesn’t even require admin panel access. In practice, it means anyone in network range can brute-force the PIN in a couple of hours (far less if you didn’t change the factory default settings). Enable WPA2 encryption in the router settings to protect your data from interception. The latest router models support WPA3, which provides even stronger security. Unfortunately, not all devices are compatible with it yet. If you have the time and energy, you may want to experiment, but even if you don’t, WPA2 will do for basic protection. You can change the type of encryption in the router settings. For more home Wi-Fi security tips, click here. What to do if your Wi-Fi is still sluggish If you’ve kicked off any uninvited guests but your connection is still too slow, then the problem lies elsewhere. Try our tips for optimizing your home Wi-Fi. Share bandwidth safely If your home network is working great, and you actually want to share your Wi-Fi with certain neighbors, set up a guest subnet for them. That way you’ll be helping out some good folks without putting your own devices at risk. Stay protected Now that you’ve made your home network a digital fortress, turn your attention to security outside the domestic zone. For those times when you have to connect to another Wi-Fi network, secure your Internet connection so that no one can steal anything from you.

Fintech Giant Fiserv Used Unclaimed Domain

krebsonsecurity Mar 17, 2021 A Little Sunshine

If you sell Web-based software for a living and ship code that references an unregistered domain name, you are asking for trouble. But when the same mistake is made by a Fortune 500 company, the results can range from costly to disastrous. Here’s the story of one such goof committed by Fiserv [NASDAQ:FISV], a show more ...

$15 billion firm that provides online banking software and other technology solutions to thousands of financial institutions. In November 2020, KrebsOnSecurity heard from security researcher Abraham Vegh, who noticed something odd while inspecting an email from his financial institution. Vegh could see the message from his bank referenced a curious domain: defaultinstitution.com. A quick search of WHOIS registration records showed the domain was unregistered. Wondering whether he might receive email communications to that address if he registered the domain, Vegh snapped it up for a few dollars, set up a catch-all email account for it, and waited. “It appears that the domain is provided as a default, and customer bank IT departments are either assuming they don’t need to change it, or are not aware that they could/should,” Vegh said, noting that a malicious person who stumbled on his discovery earlier could have had a powerful, trusted domain from which to launch email phishing attacks. At first, only a few wayward emails arrived. Ironically enough, one was from a “quality assurance” manager at Fiserv. The automatic reply message stated that the employee was out of the office “on R&R” and would be back to work on Dec. 14. Many other emails poured in, including numerous “bounced” messages delivered in reply to missives from Cashedge.com, a money transfer service that Fiserv acquired in 2011. Emails get bounced — or returned to the sender — when they are sent to an address that doesn’t exist or that is no longer active. The messages had been sent to an email address for a former client solutions director at Fiserv; the “reply-to:” address in those missives was “donotreply@defaultinstitution.com”. The messages were informing customers of CashEdge’s main service Popmoney — which lets users send, request and receive money directly from bank accounts — that Popmoney was being replaced with Zelle, a more modern bank-to-bank transfer service. Each CashEdge missive included information about recurring transfers that were being canceled, such as the plan ID, send date, amount to be transferred, the name and last four digits of the account number the money was coming from, and the email address of the recipient account. Incredibly, at the bottom of every message to CashEdge/Popmoney customers was a boilerplate text: “This email was sent to [recipient name here]. If you have received this email in error, please send an e-mail to customersupport@defaultinstitution.com.” Other services that directed customers to reply to the researcher’s domain included Fiserv customer Netspend.com, a leading provider of prepaid debit cards that require no minimum balance or credit check. The messages from Netspend all were to confirm the email address tied to a new account, and concerned “me-to-me transfers” set up through its service. Each message included a one-time code that recipients were prompted to enter at the company’s website. But from reading the many replies to these missives, it seems Netspend didn’t make it terribly obvious where users were supposed to input this code. Here’s one of the more profane examples of a customer response: Many others emailed by Netspend expressed mystification as to why they were receiving such messages, stating they’d never signed up for the service. From the gist of those messages, the respondents were victims of identity fraud. “My accounts were hacked and if any funding is gone your [sic] sued from me and federal trade commission,” one wrote. “I didn’t create the account. Please stop this account and let me know what’s going on,” replied another. “I never signed up for this service. Someone else is using my information,” wrote a third. Those messages also concerned me-to-me transfers. Other emails came from Detroit-based TCF National Bank. New York-based Union Bank also sent customer information to the researcher’s domain. Both of those messages were intended to confirm that the recipient had tied their accounts to those at another bank. And in both cases, the recipients replied that they had not authorized the linkage. In response to questions from KrebsOnSecurity, Fiserv acknowledged that it had inadvertently included references to defaultinstitution.com as a placeholder in software solutions used by some partners. “We have identified 5 clients for which auto-generated emails to their customers included the domain name “defaultinstitution.com” in the “reply-to” address,” Fiserv said in a written statement. “This placeholder URL was inadvertently left unchanged during implementation of these solutions. Upon being made aware of the situation we immediately conducted an analysis to locate and replace instances of the placeholder domain name. We have also notified the clients whose customers received these emails.” Indeed, the last email Vegh’s inbox received was on Feb. 26. This is not the first time an oversight by Fiserv has jeopardized the security and privacy of its customers. In 2018, KrebsOnSecurity revealed how a programming weakness in a software platform sold to hundreds of banks exposed personal and financial data of countless customers. Fiserv was later sued over the matter by a credit union customer; that lawsuit is still proceeding. Vegh said he found a similar domain goof while working as a contractor at the Federal Reserve Bank of Philadelphia back in 2015. In that instance, he discovered an unregistered domain invoked by AirWatch, a mobile device management product since acquired by VMWare. “After registering that domain I started getting traffic from all around the world from Fortune 500 company devices pinging the domain,” Vegh said. Vegh said he plans to give Fiserv control over defaultinstitution.com, and hand over the messages intercepted by his inbox. He’s not asking for much in return. “I had been promised a t-shirt and a case of beer for my efforts then, but alas, never received one,” he said of his interaction with AirWatch. “This time, I am hoping to actually receive a t-shirt!” Update, 12:44 p.m. ET: The lead paragraph has been updated to reflect Fiserv’s 2020 revenues, which were nearly $15 billion.

99.2% of US government Android users are running outdated OS versions

cyware Mar 17, 2021 Trends, Reports, Analysis

Android, the most popular mobile operating system, runs on plenty of devices used by U.S. government workers, but only 0.08% of those devices are running the latest version of Android, a report finds.

Nurseries sent first official cyber-attack warning

cyware Mar 17, 2021 Threat Intel & Info Sharing

Sarah Lyons, deputy director for economy and society engagement at the NCSC, said across educational settings it was "vital that all providers know how to secure their devices and sensitive data".

TIA publishes process-based supply chain security standard for the ICT industry

cyware Mar 17, 2021 Govt., Critical Infrastructure

The Telecommunications Industry Association published a new white paper on SCS 9001, a process-based supply chain security standard for the information communications technology (ICT) industry.

SBI, ICICI, HDFC, Axis Bank, PNB and the Indian IT department targeted in phishing scam

cyware Mar 17, 2021 Identity Theft, Fraud, Scams

The targeted banks in the campaign include the State Bank of India, ICICI, HDFC, Axis Bank and Punjab National Bank, revealed an investigation by CyberPeace Foundation and Autobot Infosec.

Microsoft releases one-click mitigation tool for Exchange Server hacks

cyware Mar 17, 2021 Incident Response, Learnings

Released on Monday, the tool is designed to mitigate the threat posed by four actively-exploited vulnerabilities that have collectively caused havoc for organizations worldwide.

Old Linux storage bugs, new security patches

cyware Mar 17, 2021 Malware and Vulnerabilities

A trio of security holes -- CVE-2021-27365, CVE-2021-27363, and CVE-2021-27364 -- was found by security company GRIMM researchers in an almost forgotten corner of the mainline Linux kernel.

China-based Mustang Panda APT Targets Telecom Companies to Steal 5G Secrets

cyware Mar 17, 2021 Breaches and Incidents

At least 23 telecommunications providers in Southeast Asia, Europe, and the United States, are suspected to have been targeted as part of the campaign that has been active since at least August 2020.

Cybersecurity insurance company Coalition raises $175M to secure the modern enterprise

cyware Mar 17, 2021 Companies to Watch

Coalition, an enterprise-grade cybersecurity platform that specializes in providing insurance, has raised $175 million in its Series D round of funding led by Index Ventures.

Dutch Authorities Report Microsoft Exchange Hacks Affecting at Least 1200 Servers

cyware Mar 17, 2021 Breaches and Incidents

Dutch authorities on Tuesday said that the fallout for the Netherlands from a hack on Microsoft Corp’s Exchange was substantial, with at least 1,200 Dutch servers likely to have been affected.

SolarWinds Incident Resulted in Theft of Source Code from Mimecast

cyware Mar 17, 2021 Breaches and Incidents

While hackers stole of its some source code, Mimecast added that the source code accessed by the hackers was incomplete and could not be used to build and run any component of the Mimecast service.

Security ratings could raise the bar on cyber hygiene, but won't stop the next SolarWinds

cyware Mar 17, 2021 Expert Blogs and Opinion

Plans from the Biden administration to release product security rating system could raise the bar for security overall, say experts, but won’t likely prevent the next SolarWinds or Microsoft hacks.

UK Ministry of Defence secrets exposed by people sending files to personal email accounts, documents show

cyware Mar 17, 2021 Trends, Reports, Analysis

Secret information belonging to the UK Ministry of Defence was exposed to hostile states when it was transferred from secure networks to personal email accounts, Sky News has learnt.

The Rising, Unpredictable Cases of Botnet Threats

cyware Mar 17, 2021 Trends, Reports, Analysis

A new variant of the Gafgyt botnet that uses the Tor network to target vulnerable D-Link and IoT devices, has been identified by NetLab 360 researchers.

China suspected of cyber attack on Western Australia's Parliament during state election

cyware Mar 17, 2021 Breaches and Incidents

Western Australia's parliamentary email network was hit by suspected Chinese hackers earlier this month as part of a massive global cyber-attack involving Microsoft software.

Apple May Start Delivering Security Patches Separately From Other OS Updates

cyware Mar 17, 2021 Mobile Security

According to code spotted in iOS 14.5, the iPhone maker is reportedly working on a method for delivering security fixes independently of other OS updates, first reported by the 9to5Mac website.

The Microsoft Exchange hack: Sharing bug intel is vital, but not without risk

cyware Mar 17, 2021 Expert Blogs and Opinion

Microsoft is investigating whether hackers obtained information about Exchange bugs after it privately shared certain details, including proof-of-concept exploit code, with various security partners.

Acronis acquires Synapsys to extend cyber protection solutions to organizations across Africa

cyware Mar 17, 2021 Companies to Watch

Acronis announced to acquire Synapsys, its partner located in Cape Town, South Africa that specializes in distributing Acronis Cyber Protection Solutions through the service provider channel.

Sensitive data from US shipping management software firm exposed online

cyware Mar 17, 2021 Breaches and Incidents

The data, which belonged to New Jersy based Descartes Aljex Software, was exposed by a misconfigured AWS S3 Bucket which left it unsecured and vulnerable to intrusion by attackers.

Threat actors thriving on the fear and uncertainty of remote workforces

cyware Mar 17, 2021 Trends, Reports, Analysis

The WFH reality resulted in an unprecedented change for organizations as they fought to defend exponentially greater attack surfaces from cybercriminals armed with powerful cloud-based tools.

Teen responsible for major Twitter hack to serve three years in prison

cyware Mar 17, 2021 Threat Actors

A teenager responsible for a massive bitcoin scam last year that involved hacking Twitter accounts for various politicians and other high-profile figures has been sentenced to three years in prison.

25% of UK Workers Let Their Children Use Their Work Device

cyware Mar 17, 2021 Trends, Reports, Analysis

A quarter (25%) of the surveyed UK workers said they allow their children to use their corporate device for home-schooling and other purposes, according to a YouGov survey conducted by iomart.

New UK Cyber Security Council to be official governing body on training and standards

cyware Mar 17, 2021 Security Culture

The UK government has set up a new independent body, the UK Cyber Security Council, to boost career opportunities and professional standards for the UK’s booming cyber security sector.

Microsoft's latest cloud authentication outage: What went wrong

cyware Mar 17, 2021 Incident Response, Learnings

Microsoft has published a preliminary root cause analysis of its March 15 Azure Active Directory outage, which took down Office, Teams, Dynamics 365, Xbox Live, and other apps.

Mimecast Says SolarWinds Hackers Breached Its Network And Spied On Its Customers

packetstormsecurity Mar 17, 2021 headline,hacker,privacy,microsoft,email,

Adobe Forces Takedown Of Tweet Linking To 27-Year-Old Product

packetstormsecurity Mar 17, 2021 headline,fraud,flaw,adobe,twitter

Teen Mastermind Pleads Guilty To Celeb Twitter Hack

packetstormsecurity Mar 17, 2021 headline,hacker,twitter