Netizen Blog and News

Overview

• Phish Tale of the Week
• Sprint Breach Exposes Customer Data
• Critical Flaw Found In VLC Media Player
• How Can Netizen/CyberSecure Solutions help? 

Phish Tale of the Week

As is typical for most businesses, our HQ Office inbox receives the occasional phishing email attempting to trick an employee into sending the perpetrator some sort of payment or money order. In this case, the perpetrator was impersonating CyberSecure Solutions CEO, Michael W. Hawkins. Fortunately, Netizen and CyberSecure Solutions staff are regularly trained in email phishing and social engineering awareness. The attempt pictured below can be deconstructed and analyzed to point out the obvious, and not so obvious, details that prove this email to be fraudulent. 

Take a look below:

Some tell-tale signs that raise suspicions:

1. The first detail shows that this email is being sent from an EXTERNAL account outside of the Netizen/CyberSecure environment. 
2. Second, we can see multiple text and grammar errors, such as examples 2 and 3. 
3. Example 4 shows an unprofessional signature to the email, which does not match the standard company signature. 

General Recommendations:

A phishing email will typically direct the user to visit a website where they are asked to update personal information, such as a password, credit card, social security, or bank account information. A legitimate company already has this sensitive information and would not ask for it again, especially via email. 

• Scrutinize your emails before clicking anything. Did you order, or ask for, anything for which you’re expecting a confirmation? Did the email come from a store you don’t usually order supplies from or a service you don’t use? If so, it’s probably a phishing attempt.
• Verify that the sender is actually from the company sending the message.
• Did you receive a message or email from someone you don’t recognize? Are they asking you to sign into a website to give Personally Identifiable Information (PII) such as credit card numbers, social security number, etc. A legitimate company will never ask for PII via instant message or email—this is a huge red flag.
• Do not give out personal or company information.
• Review both signature and salutation.
• Do not click on attachments.
• Do not click on unrecognized links. If you do proceed, verify that the URL is the correct one for the company/service and it has the proper security in place, such as HTTPS.
• Be wary of poor spelling, grammar, and formatting. As can be seen with the with this email, there are multiple spelling, grammar, and formatting errors, leading us to believe that the message is illegitimate. If an email is visually unprofessional, the sender is likely not who they say they are.

Many phishing emails pose a sense of urgency or even aggressiveness to prompt a form of intimidation. Any email requesting immediate action or that is addressing you in a threatening manner should be questionable. Also, beware of messages that seek to tempt users into opening an attachment or visiting a link. For example, an attachment titled “Staff Pay Raises 2019” may seem like something you really want to know about, but it could just be a ploy to plant malware on your system or steal your credentials.

Cybersecurity Brief

In this week’s Cybersecurity Brief: Sprint Customer Data Breached via Samsung Website Flaw, Critical Flaw Found in VLC Media Player

Sprint Customer Data Exposed

Sprint informed its customers that a major security breach took place on June 22. Hackers used an undefined vulnerability on a promotional Samsung website to obtain Sprint customer information. The amount of accounts breached has not been disclosed yet, but Sprint stated that among the exposed data was customers’ cellphone numbers, addresses, device types, device ID’s account numbers, and first and last names. The company promptly secured the vulnerability, changing the PINs for accounts that may have been compromised, and informed its customers of the event as well as recommendations to change their account passwords to avoid any possible exploits. Those affected have also been notified to place fraud alerts on their credit reports, monitor their credit changes and file a report of any suspected cases of identity theft.

Experts warn any victims of the breach to follow the recommended actions take this breach seriously. “Regardless of the number of individuals affected, the type of information hackers had access to leaves Sprint customers vulnerable to identity theft and fraudulent activity,” Bitglass Chief Technology Officer Anurag Kahol said. “When armed with payment card information and personally identifiable information (PII), malicious parties can engage in highly targeted phishing attacks, make fraudulent purchases, sell said data on the dark web for a quick profit, and much more.”   

To read more about the Sprint breach, click here.

VLC Media Player Vulnerability Leaves PCs Exposed

VLC Media Player is a free and open-source, cross-platform multimedia player and framework that plays most multimedia files as well as DVDs, Audio CDs, VCDs, and various streaming protocols. The tool is a very popular program that operates on Windows, Linux, Mac OS X, Unix, iOS, and Android systems. However, with its popularity and cross-platform capabilities, the program has caused concern for users after news broke that the VLC Media Player might be leaving PCs vulnerable to being hacked remotely. 

Identified as CVE-2019-13615, the vulnerability in the hugely popular VLC Media Player (v 3.0.7.1) was recently discovered by Germany’s national Computer Emergency Response Team (CERT Bund). CERT Bund also stated that the affected systems are Windows, Linux or Unix machines, leaving machines operating on Mac OSX secure. Apparently, the flaw has left billions of computers exposed to Remote Code Execution (RCE) where hackers can get unauthorized access to install and execute malicious code and modify files/data on target machines and cause disruption through denial-of-service attacks (a cyber-attack in which the perpetrator seeks to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a host connected to the Internet). The good news is that there are no examples of this vulnerability being exploited in the wild, although many users have begun uninstalling the VLC Media Player as a safety measure. 

Recommendations: Until further notice from VLC or VideoLAN, halt usage of the program and instead use an alternative option like Windows Media Player. Monitor the situation and wait for the company to release a patched update for the program before resuming using the tool. 

To read more about the vulnerability, click here.

The Big Picture:

No business or organization is invulnerable to a cyberattack, as these incidents prove. Business and safety operations can be heavily impacted and result in the loss of millions of dollars. To better protect your business or organization, take a proactive stance about cybersecurity. 

How Can CyberSecure Solutions Help?

CyberSecure Solutions ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service,” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

Additionally, CyberSecure offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers. To schedule a LIVE demo of the Overwatch Governance Suite, click here.

CyberSecure Solutions is the commercial brand of Netizen Corporation, an ISO 27001:2013 (Information Security Management) certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans. 

Copyright © 2019 Netizen Corporation. All rights reserved.

Overview

• Phish Tale of the Week
• Microsoft’s BlueKeep Proves Vulnerable
• Critical Warning Issued for Samsung Cellphone Update App
• How Can Netizen Help?

Phish Tale of the Week

Phishing attempts are often carried out with urgent messages that are meant to provoke the victim to act without rationally thinking about the contents of the email. In this instance, an employee received an email message from their boss asking them to buy Amazon gift cards for his best friend’s son’s birthday. 

Take a look below:

1. The first tell-tale sign is the “boss” emailing the employee for a personal favor, and asking for it urgently.
2. A second attempt at urging the victim to act quickly and ignore rational thinking. 
3. Improper grammar is used throughout the email, including the highlighted line.
4. A very shady way of loading money onto a gift card is being requested, further raising suspicions. 

General Recommendations:

A phishing email will typically direct the user to visit a website where they are asked to update personal information, such as a password, credit card, social security, or bank account information. A legitimate company already has this sensitive information and would not ask for it again, especially via email. 

• Scrutinize your emails before clicking anything. Did you order, or ask for, anything for which you’re expecting a confirmation? Did the email come from a store you don’t usually order supplies from or a service you don’t use? If so, it’s probably a phishing attempt.
• Verify that the sender is actually from the company sending the message.
• Did you receive a message or email from someone you don’t recognize? Are they asking you to sign into a website to give Personally Identifiable Information (PII) such as credit card numbers, social security number, etc. A legitimate company will never ask for PII via instant message or email—this is a huge red flag.
• Do not give out personal or company information.
• Review both signature and salutation.
• Do not click on attachments.
• Do not click on unrecognized links. If you do proceed, verify that the URL is the correct one for the company/service and it has the proper security in place, such as HTTPS.
• Be wary of poor spelling, grammar, and formatting. As can be seen with the with this email, there are multiple spelling, grammar, and formatting errors, leading us to believe that the message is illegitimate. If an email is visually unprofessional, the sender is likely not who they say they are.

Many phishing emails pose a sense of urgency or even aggressiveness to prompt a form of intimidation. Any email requesting immediate action or that is addressing you in a threatening manner should be questionable. Also, beware of messages that seek to tempt users into opening an attachment or visiting a link. For example, an attachment titled “Staff Pay Raises 2019” may seem like something you really want to know about, but it could just be a ploy to plant malware on your system or steal your credentials.

Cybersecurity Brief

In this week’s Cybersecurity Brief: Microsoft’s BlueKeep Vulnerability Proved Exploitable, Critical Warning for Scam Samsung Update App

Microsoft’s BlueKeep Proves Vulnerable 

Late last month, Microsoft’s Security Response Team (MSRC) issued a warning to organizations to update and install patches to BlueKeep (CVE-2019-0708), a critical remote code execution vulnerability it patched in early June. The flaw, which affects older versions of Windows and is found in Remote Desktop Protocol (RDP), allows attackers to execute code remotely on a machine without the need to log in. The flaw requires no user interaction, a feature that’s caused concern for future malware which can be developed to exploit the bug and spread the malware across other vulnerable machines. Initially, when the patch was released on May 14, Microsoft had not seen the BlueKeep bug exploited in the wild. However, Microsoft acknowledged that it is “highly likely” that this bug can be exploited by malicious actors and cybercriminals.

Now, almost two months later, BlueKeep discoverer and security researcher Kevin Beaumont stated that there are over a million systems on the internet with RDP exposed publicly and, to underscore the importance of applying Microsoft’s patch as soon as possible, Sophos also released a proof of concept video showing BlueKeep being exploited. This dashed the hope that the difficulty in executing the code would slowdown potential exploitation by criminals. The good news is that there is no evidence of BlueKeep being exploited in the wild.  
 
To read more about the BlueKeep vulnerability, click here.

Critical Warning Issued for Samsung Cellphone App

Installing a firmware/update-manager for your phone helps to ensure your phone is secure. However, for 10 million Samsung smartphone users, this has become the complete opposite. Aleksejs Kuprins, a malware analyst at CSIS Security Group, revealed how an app called “Updates for Samsung” has been installed by over 10 million users directly from the Google Play Store. The app promises free firmware updates but redirects users to an ad-filled website and asks for money to install the updates. This $34.99/year service, which is supposed to be free, doesn’t use the Google Play Store to manage the subscription. Instead, it uses a separate payment processing system to pay the fee. The download speed is also restricted to 56 Kbps and asks users pay more money for faster speeds or premium packages. Kuprins also noted that free downloads almost always failed to complete. Overall, the app is not doing what it’s advertising to do. 

So, what should you do? If you have this app installed, it’s recommended to remove it from your phone as well as dispute any transactions if you paid for the service. Additional advice would be not to download apps like this going forward. Instead, follow Samsung’s procedures for downloading updates, which appear as a notification and walk you through the simple, speedy, and secure process for updating your phone. If you want to check on the status of your device’s firmware, simply navigate to the “Software Update” option in the settings menu and select “Download and install” to check if you are running the latest updates; if not, then the download will start and the update will be completed in a few minutes. By following these recommendations, the updates are guaranteed to come directly from the vendor and are always free. 

The Big Picture:

No business or organization is invulnerable to a cyberattack, as these incidents prove. Business and safety operations can be heavily impacted and result in the loss of millions of dollars. To better protect your business or organization, take a proactive stance about cybersecurity. 

How Can Netizen Help?

Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

Netizen is an ISO 27001:2013 (Information Security Management) certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans. 

Copyright © 2019 Netizen Corporation. All rights reserved.

Overview

• Phish Tale of the Week
• Vulnerability in TP-Link’s Wi-Fi Extenders Could Allow Remote Control to Attackers
• Latest Phishing Scam Impersonates Apple Support
• How Can Netizen Help?

Phish Tale of the Week

Phishing attempts can often target specific groups that can be exploited by malicious actors. In this instance, we see a phishing email targeting Bank of America customers. The email seems to be a security notification about “unusual activity” on the bank account and urgent care is required. The email even contains the logo of the bank and the official website linked in the body, so it must be a real notification, right? Not so fast. The email has a few tell-tale signs of its in-authenticity.

Take a look below:

1. Notice the way that the “Bank of America” display name does not match the email format in the “From” field.
2. In the “To” field as well as the greeting, there is a general salutation that is very vague and can be applied to anyone receiving the email.
3. While hovering your cursor over the link, it is clearly a different link than the one provided in the body of the email.
4. There are clear grammatical and spelling errors throughout the text, all of which indicate that the author is not very professional. 

General Recommendations:

A phishing email will typically direct the user to visit a website where they are asked to update personal information, such as a password, credit card, social security, or bank account information. A legitimate company already has this sensitive information and would not ask for it again, especially via email. 

• Scrutinize your emails before clicking anything. Did you order, or ask for, anything for which you’re expecting a confirmation? Did the email come from a store you don’t usually order supplies from or a service you don’t use? If so, it’s probably a phishing attempt.
• Verify that the sender is actually from the company sending the message.
• Did you receive a message or email from someone you don’t recognize? Are they asking you to sign into a website to give Personally Identifiable Information (PII) such as credit card numbers, social security number, etc. A legitimate company will never ask for PII via instant message or email—this is a huge red flag.
• Do not give out personal or company information.
• Review both signature and salutation.
• Do not click on attachments.
• Do not click on unrecognized links. If you do proceed, verify that the URL is the correct one for the company/service and it has the proper security in place, such as HTTPS.
• Be wary of poor spelling, grammar, and formatting. As can be seen with the with this email, there are multiple spelling, grammar, and formatting errors, leading us to believe that the message is illegitimate. If an email is visually unprofessional, the sender is likely not who they say they are.

Many phishing emails pose a sense of urgency or even aggressiveness to prompt a form of intimidation. Any email requesting immediate action or that is addressing you in a threatening manner should be questionable. Also, beware of messages that seek to tempt users into opening an attachment or visiting a link. For example, an attachment titled “Staff Pay Raises 2019” may seem like something you really want to know about, but it could just be a ploy to plant malware on your system or steal your credentials.

Cybersecurity Brief

In this week’s Cybersecurity Brief: Vulnerability in TP-Link Wi-Fi extenders Could Allow Remote Control to Attackers, Latest Phishing Scam Impersonates Apple Support

TP-Link Wi-Fi Extenders Vulnerability

A WiFi Extender is a device that repeats the wireless signal from your router to expand its coverage. It functions as a bridge, capturing the Wi-Fi from your router and rebroadcasting it to areas where the Wi-Fi is weak or nonexistent, improving the performance of your home Wi-Fi. With many internet users often not having enough coverage around their homes or office space, a simple solution is to use an extender to receive coverage to areas that are lacking it. However, TP-Link, a global leader in networking devices and accessories, disclosed that a vulnerability in the TP-Link RE365 Wi-Fi extender version 1.0.2 could allow an attacker to take complete control over the device.  

The vulnerability, tracked as CVE-2019-7406, could allow a remote attacker to perform arbitrary command execution via specially crafted user agent fields in HTTP headers. The attack works by sending a malicious HTTP request to the Wi-Fi extender. The vulnerability of TP-Link’s Wi-Fi extender allows a potential attacker to execute commands from the request. The attacker would need to know the extender’s IP address to exploit the vulnerability, but you can find thousands of exposed devices on IoT search engines like Shodan. More sophisticated attacks can be carried out due to the level of access that an attacker would assume, including potentially redirecting people to pages with malware, as well as taking over the routers to use as part of a botnet. 
 
The vulnerability affects home and office users alike, which can put private and business data at risk. the affected TP-Link devices are the RE365 model as well as the RE650, RE350 and RE500 devices. However, TP-Link responsibly disclosed the vulnerability and released software updates to patch the flaw.  
 
To read more about the TP-Link vulnerability, click here. 

Phishing Scam Impersonates Apple Support

The telephone version of phishing is called vishing. Vishing relies on “social engineering” techniques to trick you into providing information that others can use to access and use your important accounts. People can also use this information to assume your identity and open new accounts. Vishing attacks are designed to generate fear and immediate response and therefore occur within short time frames. For example, a vishing perpetrator (visher) may gain access to a group of private customer phone numbers and call the numbers from the group. When a potential victim answers the phone, he or she hears an automated recording informing him that his bank account or social security information has been compromised. The victim is then instructed to call the “toll-free” number included in the message and also enter personal information like bank account numbers and social security numbers for “verification.” The victim’s entries are collected and then used to access their bank accounts or steal their identity.

 
The latest vishing scam making the rounds involves scammers pretending to be Apple Support Agents alerting Apple users that their account has fallen victim to a data breach. Scammers implement a spoofing technique to imitate the real Apple support telephone number, often showing up on Caller ID as ” 1 (800) MYAPPLE,” even though the fake call is coming from another country. On Apple devices, the fake call even displays the Apple logo and either “Apple Customer Service” or “AppleCare” to trick users into thinking the call is authentic. The goal of the scammers is to gather iCloud or Apple ID account information of victims. Apple announced that iOS 13 will include a feature that forces unknown calls to go straight to voicemail, a feature which will likely debut in the fall. In the meantime, Apple is advising users not to answer questionable phone calls from Apple Support. If you are concerned about the status of your Apple account, contact Apple directly.  

The Big Picture:

No business or organization is invulnerable to a cyberattack, as these incidents prove. Business and safety operations can be heavily impacted and result in the loss of millions of dollars. To better protect your business or organization, take a proactive stance about cybersecurity. 

How Can Netizen Help?

Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

Netizen is an ISO 27001:2013 (Information Security Management) certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans. 

Copyright © 2019 Netizen Corporation. All rights reserved.

Overview

• Phish Tale of the Week
• Microsoft Urges Users to Patch BlueKeep Security Flaw
• U.S. Customs and Border Protection Data Breach
• How Can Netizen Help?

Phish Tale of the Week

Malicious actors are constantly finding new ways to target a big payday. In the newest trend, these cyber criminals are using secured websites to run their own phishing campaigns. 

The criminals are relying on people’s trust in landing pages that contain “HTTPS” in the URL and TLS secured sites. After a phishing email is sent and the victim clicks forward onto the link, they will see a secured certificate on the site, but it’s all a ruse. In reality, the landing pages are only secured to play on the trust of victims and will capture any login credentials or information that a victim submits. This tactic was used in phishing campaigns such as the one that imitated Netflix’s log-in page to harvest login credentials. 

Take a look below:

1. While the login page seems very convincing and is almost too good to set apart from the real login page, notice the strange website URL that says “GroupNetflix”.   
2. Notice the extra space between the “Sign Up Now” button and the period. 

General Recommendations:

A phishing email will typically direct the user to visit a website where they are asked to update personal information, such as a password, credit card, social security, or bank account information. A legitimate company already has this sensitive information and would not ask for it again, especially via email. 

• Scrutinize your emails before clicking anything. Did you order, or ask for, anything for which you’re expecting a confirmation? Did the email come from a store you don’t usually order supplies from or a service you don’t use? If so, it’s probably a phishing attempt.
• Verify that the sender is actually from the company sending the message.
• Did you receive a message or email from someone you don’t recognize? Are they asking you to sign into a website to give Personally Identifiable Information (PII) such as credit card numbers, social security number, etc. A legitimate company will never ask for PII via instant message or email—this is a huge red flag.
• Do not give out personal or company information.
• Review both signature and salutation.
• Do not click on attachments.
• Do not click on unrecognized links. If you do proceed, verify that the URL is the correct one for the company/service and it has the proper security in place, such as HTTPS.
• Be wary of poor spelling, grammar, and formatting. As can be seen with the with this email, there are multiple spelling, grammar, and formatting errors, leading us to believe that the message is illegitimate. If an email is visually unprofessional, the sender is likely not who they say they are.

Many phishing emails pose a sense of urgency or even aggressiveness to prompt a form of intimidation. Any email requesting immediate action or that is addressing you in a threatening manner should be questionable. Also, beware of messages that seek to tempt users into opening an attachment or visiting a link. For example, an attachment titled “Staff Pay Raises 2019” may seem like something you really want to know about, but it could just be a ploy to plant malware on your system or steal your credentials.

Cybersecurity Brief

In this week’s Cybersecurity Brief: Microsoft Urges Businesses to Patch “BlueKeep” Flaw, Hackers Steal Border Agency Traveler Photos

Microsoft Urges Businesses to Patch “BlueKeep” Flaw 

Microsoft’s Security Response Team (MSRC) is warning organizations to patch BlueKeep (CVE-2019-0708), a critical remote code execution vulnerability it patched earlier this month. The flaw affects older versions of Windows and is found in Remote Desktop Services (RDS). The flaw requires no user interaction, a feature that can be a cause for concern if future malware is developed to exploit the bug and spread the malware across other vulnerable machines. Initially, when the patch was released on May 14, Microsoft had not seen the BlueKeep bug exploited in the wild. However, Microsoft acknowledged that it is “highly likely” that this bug can be exploited by malicious actors and cybercriminals. Now, Microsoft says they are “confident” that an exploit exists for this vulnerability and more than one million internet-connected machines remain vulnerable to BlueKeep.

In Microsoft’s official blog, the MSRC stated “It only takes one vulnerable computer connected to the internet to provide a potential gateway into these corporate networks, where advanced malware could spread, infecting computers across the enterprise. The scenario is even more dangerous for those who neglected to update internal systems, they continue, as future malware could try to exploit vulnerabilities that have already been patched.” The vulnerable systems are the ones still running Windows XP, Windows 7, Server 2008 and Server 2008 R2. Microsoft continues to urge users to update their systems to ensure the latest patches and security features are installed and enabled on their machines out of fear of a repeat of the 2017 ransomware attack known as WannaCry.

Security Researchers at Kenna Security are monitoring for any activity involving the BlueKeep bug and can confirm that there have already been attempts to reverse the patch and build an exploit by cybercriminals. The research group also estimates that there are still a significant amount of organizations that can be vulnerable to this attack, especially ones still using Windows 7 and Server 2008. One possible scenario in which cybercriminals can carry out an attack is exploiting BlueKeep by connecting to a target system via Remote Desktop Protocol RDP and sending specially crafted requests. If successful, criminals could execute code on a target system. Even if Windows 7 and Server 2008 are not exposed to the Internet, they’re susceptible to exploitation via a multi-pronged attack.
Microsoft has released a patch for the vulnerability. If your business or organization operates a system running one of the listed vulnerable operating systems, Microsoft highly recommends that you update your systems to ensure the patch is installed.

To read more about the BlueKeep bug, click here.

Hackers Steal Border Agency Database of Traveler Photos

The U.S. Customs and Border Protection (CBP) agency revealed that one of its subcontractors has been breached and a database containing images of travelers and license plates was stolen. The Customs and Border Protection agency declined to reveal the breached subcontractor but there is mounting evidence that Tennessee-based company Perceptics is the victim. The company develops and produces license plate readers that are used by the CBP. The subcontractor was breached because it had stored license plate images and traveler’s images on its own network, without the knowledge of CBP. The agency has declined to reveal how many people have been affected or the size of the data breach, which can mean that it is larger than expected. 

Surprisingly, this is not the first time that Perceptics has been involved in a data leak. An incident in May involved one hacker dumping hundreds of gigabytes of data stolen from Perceptics on the dark web. It is unknown if the two incidents are somehow connected but the Customs and Border Patrol agency insists that it had no knowledge to Perceptics data transfer. What’s more worrying, however, is that the CBP allowed a third party to access sensitive data without its knowledge and did not ensure that its subcontractors had the appropriate security measures in place. 

The agency outlined its security standards in an official statement, saying “CBP requires that all contractors and service providers maintain appropriate data integrity and cybersecurity controls and follow all incident response notification and remediation procedures. CBP takes its privacy and cybersecurity responsibilities very seriously and demands all contractors to do the same.”

The Big Picture:

No business or organization is invulnerable to a cyberattack, as these incidents prove. Business and safety operations can be heavily impacted and result in the loss of millions of dollars. To better protect your business or organization, take a proactive stance about cybersecurity. 

To read the original article, click here.

How Can Netizen Help?

Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

Netizen is an ISO 27001:2013 (Information Security Management) certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans. 

Copyright © 2019 Netizen Corporation. All rights reserved.

Overview

• Phish Tale of the Week
• First American Financial Corp. Leaks 800+ Million Records
• Google Begins Tracking “zero-day” Exploits
• How Can Netizen Help?

Phish Tale of the Week

One way a malicious actor can try to collect a business’ sensitive information is by targeting the business’ employees. Attempting to phish an employee requires some research about the company and the potential victim. The following is a phishing attempt that was received in our office last week. 

This particular phishing attempt is almost unidentifiable because of the degree of attention that must be paid to pick out the telling factors. The email addresses the recipient by name, indicating that there was some research done to find the individual’s full name and email address. This process is called “social engineering” and is used to collect a victim’s information.

Take a look below:

1. Some tell-tale signs that raise suspicions:The first sign of an email received from outside of the Netizen environment is the “EXTERNAL” tag in the email subject line.  
2. The email contains a typo where the recipient is encouraged to call for questions, but a phone number was never provided. 
3. An unusually long site address from “AWStrackme” appears at the bottom of the email. 

General Recommendations:

A phishing email will typically direct the user to visit a website where they are asked to update personal information, such as a password, credit card, social security, or bank account numbers. A legitimate company already has this sensitive information and would not ask for it again, especially via email. 

• Scrutinize your emails before clicking anything. Did you order or ask for anything for which you’re expecting a confirmation? Did the email come from a store you don’t usually order supplies from or a service you don’t use? If so, it’s probably a phishing attempt.
• Verify that the sender is actually from the company sending the message.
• Did you receive a message or email from someone you don’t recognize? Are they asking you to sign into a website to give Personally Identifiable Information (PII) such as credit card numbers, social security number, etc. A legitimate company will never ask for PII via instant message or email—this is a huge red flag.
• Do not give out personal or company information.
• Review both signature and salutation.
• Do not click on attachments.
• Do not click on unrecognized links. If you do proceed, verify that the URL is the correct one for the company/service and it has the proper security in place, such as HTTPS.
• Be wary of poor spelling, grammar, and formatting. As can be seen with the with this email, there are multiple spelling, grammar, and formatting errors, leading us to believe that the message is illegitimate. If an email is visually unprofessional, the sender is likely not who they say they are.

Many phishing emails pose a sense of urgency or even aggressiveness to prompt a form of intimidation. Any email requesting immediate action or that is addressing you in a threatening manner should be questionable. Also, beware of messages that seek to tempt users into opening an attachment or visiting a link. For example, an attachment titled “Staff Pay Raises 2019” may seem like something you really want to know about, but it could just be a ploy to plant malware on your system or steal your credentials.

Cybersecurity Brief

In this week’s Cybersecurity Brief: First American Financial Corp. Leaked Hundreds of Millions of Insurance Records, Google Begins Tracking “Zero-Day” Vulnerabilities

First American Corp. Title Insurance Records Leak

First American Financial Corp., a Fortune 500 Company, is a national leading provider of title insurance and settlement services to the real estate and mortgage industries with millions of customers. Late last week, it was discovered that First American’s website has a major security flaw that allows anyone with a URL to a document held by the company to access other documents simply by changing a single digit in the URL. The website reportedly has exposed more than 800 million files dating all the way back to 2003. The digital files include many forms of sensitive customer information that could be used by malicious actors, including: bank account numbers and statements, mortgage and tax records, Social Security numbers, wire transaction receipts, and drivers license images. Many of the exposed files are records of wire transactions with bank account numbers and other information from home or property buyers and sellers.

A spokesman for First American Financial Corp. shared the following statement:

“First American has learned of a design defect in an application that made possible unauthorized access to customer data.  At First American, security, privacy and confidentiality are of the highest priority and we are committed to protecting our customers’ information. The company took immediate action to address the situation and shut down external access to the application. We are currently evaluating what effect, if any, this had on the security of customer information. We will have no further comment until our internal review is completed.”

The information released by this security flaw could be a potential gold mine to phishers and scammers looking to cash-in on this data leak. With access to home addresses, bank account numbers and social security information, scammers can try to convince a homeowner to wire funds to a fraudulent account.

For First American Financial Corp. Customers, it is recommended that you:

• Closely monitor the situation and pay attention to the company’s updates.
• Monitor your bank account and credit statements for suspicious activities.
• Do NOT provide any information to calls/emails asking you to wire funds. Contact First American Financial Corp. Customer Service if you receive such calls. 

To read more about the First American Financial Corp. leak, click here.

Google Begins Tracking Zero-Day Vulnerabilities 

The Google Project Zero team, a group of top Google security researchers with the sole mission of tracking down and neutralizing the most harmful security flaws in the world’s software, has begun documenting zero-day vulnerabilities exploited in the wild. These secret hack-able flaws, known in the security industry as “zero-day” vulnerabilities, are exploited by criminals, state-sponsored hackers and intelligence agencies in their spying operations. 

The security research team is compiling a list of these vulnerabilities that had been exposed before the vendor of the software could patch the security flaws. The spreadsheet currently lists over 100 vulnerabilities exploited in the wild since 2014. The table includes the flaw’s CVE identifier, impacted vendor, impacted product, the type of vulnerability, a brief description, the date of its discovery, the date when a patch was released, a link to the official advisory, a link to a resource analyzing the flaw, and information on attribution. The list currently includes vulnerabilities affecting products from Facebook, Microsoft, Google, Apple, Adobe, Mozilla, Cisco, Oracle, IBM and Ghostscript. The data from this research shows that, on average, there is a new exploit identified every 17 days. The data also reveals that it takes vendors roughly 15 days to patch the exploited flaw after it becomes public. 

The Big Picture:

No business or organization is invulnerable to a cyberattack, as these incidents prove. Business and safety operations can be heavily impacted and result in the loss of millions of dollars. To better protect your business or organization, take a proactive stance about cybersecurity. 

To read the original article by SecurityWeek, click here.

How Can Netizen Help?

Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

Netizen is an ISO 27001:2013 (Information Security Management) certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans. 

Copyright © 2019 Netizen Corporation. All rights reserved.