Everyday is Cybersecurity Awareness Day

[MPMalloy]

Sometimes though, you can take security a little too far and screw yourself over:

https://www.foxnews.com/tech/cryptocurr ... eports-say

I read that on NPR. Very poor business planning. No idea about disaster recovery or chain/line of succession in of catastrophe.

Big-Time-FAIL. He knew he had the medical condition. It was all on him & now everybody else pays for his mistake.

I don't see insurance covering the loss. Maybe...I dunno. I was a personal lines guy.

[MPMalloy]

From Bloomberg: One of Russia’s Neighbors Has Security Lessons for the Rest of Us

Also:

[JasinSwift]

Agree with this topic.
Currently, we are living in the Cyber-age where Internet & computers have foremost impacts on our way of living and social life. The usage of information technology has posed great safety challenges and moral questions in front of us. Decided to use the services of software developers for protecting my bussnies now - https://clockwise.software/blog/category/business/ . Thanks for motivation

[flybynight]

The number of spear phishing emails at my place of work is at a staggering level. Never click on links unless positive knowledge of the sender. ( example family member telling you by phone they are sending a link,)
If you receive email thanking you for the $1400.00 order you didn't make. The electric company is shutting off your power, Or even your bank warning you of possible fraudulent activity. Don't click on the link. No legitimate business is using this method of contact anymore.
This also includes phone calls/txts. If you are not expecting a call from a business or don't recognize the number or locality of call origination. It's some type of fraudulent attempt to gain information from you or access to your phone and anything stored on it.

[JayceSlayn]

The number of spear phishing emails at my place of work is at a staggering level. Never click on links unless positive knowledge of the sender. ( example family member telling you by phone they are sending a link,)
If you receive email thanking you for the $1400.00 order you didn't make. The electric company is shutting off your power, Or even your bank warning you of possible fraudulent activity. Don't click on the link. No legitimate business is using this method of contact anymore.
This also includes phone calls/txts. If you are not expecting a call from a business or don't recognize the number or locality of call origination. It's some type of fraudulent attempt to gain information from you or access to your phone and anything stored on it.

A while back the "CEO" of my company sent me an email asking me to simply contact them back as soon as possible, but that they were in a meeting, so to respond to their email rather than calling them. I responded to the email (something like "OK - what do you need?"), but the follow-up response was definitely out of character (asking me to purchase a bunch of gift cards for the people they were in a meeting with ASAP). I then checked the sender's address and found that they'd spoofed the CEO's email account. No further responses to them, but I did forward the exchange to our actual CEO for reference. I assume that they gathered enough information from the public company site or LinkedIn to make a passable attempt.

Generally, when I get any kind of official correspondence to my personal account (e.g. water bill, bank statement notification, fraud alert, etc.) I will read it, but never use any of the links or contact numbers in the email to respond. I will go to the official site and log-in there or use the contact phone numbers from the website instead. It helps reduce the chance that a phisher will redirect you via email.

[JayceSlayn]

In other news today, MIT Technology Review posted a good article about spreading "Triton"/"Triss" malware, targeting industrial safety controllers: https://www.technologyreview.com/s/6130 ... n-malware/. If you somehow hadn't heard of the Stuxnet or Russia hacking Ukraine electrical grid stories, they cover those briefly as well, but there are even better full stories elsewhere.

I am far from a luddite when it comes to interconnected industrial technology - some people like the term Industrial Internet of Things (IIoT), but I don't like that whole concept as much as I don't like normal IoT. I've had a hand in proliferating the industrial interconnectedness of data/controllers/etc. and it is clearly an unstoppable change in business because of the efficiency it can bring. Nonetheless, I am resistant to its over-application, and I think security must always be taken as a high priority, particularly in instances where it doesn't appear to be of great concern.

A lot of devices that we might invite into our houses and workplaces may seem convenient and productive, but do their manufacturers and/or implementers take security into account? Things like WiFi routers, PLCs, Nest, Alexa, and even things as sophisticated as cell phones and laptops each bring a lot of extra attack surface with them. Not every business is going to be able to afford in-depth security auditing for every project, or able to follow best-practice guidelines perfectly every time. Unfortunately, you have to be perfect all the time, or wrong once, to make the difference against a sophisticated attacker. The attack surface across many industries is already very large, and we have a lot of catching up to do before I'd start to feel "safe" with it.

I've added a generic "State-actor cyber attack" to my list of possible scenarios to prepare for. The extent of which could range from inconvenient to catastrophic depending on the specifics, but preparing for the zompocalypse is a good goal, as always.

[MPMalloy]

From The AP: 8 days after cyberattack, Baltimore’s network still hobbled

[Adamski]

Decentralization seems to be key when it comes to device security. Which is hard to do when everything is linked to your email account.

The term "attack surface" makes a lot more sense to me now. Like in physical security, vulnerability will always exist and it is amplified by your overall exposure. It's more a matter of where you land on the spectrum than a binary situation of secure/not secure.

[MPMalloy]

From NPR: Ransomware Cyberattacks On Baltimore Put City Services Offline

[JayceSlayn]

From NPR: Ransomware Cyberattacks On Baltimore Put City Services Offline

Ransomware attacks continue to work because the amount of the ransom is often insignificant compared to the operational value that the encrypted data embodies. This is particularly the case for municipalities and businesses, although sometimes a several hundred dollar ransom for a personal computer may be deemed too much.

Try to not be an easy target in the first place by keeping your systems updated and using other good security practices, and keep frequent offline/"cold" or distributed (e.g. cloud service) backups of data that you consider critical or irreplaceable. Flash drives and external hard drives are cheap, and though it is a pain to frequently un-plug/re-plug them to keep them updated, keeping them unattached is the only way you can ensure that they aren't also encrypted during an attack.

[Stercutus]

Our city policy is no flash drives. The risk is too high. In fact most, if not all of the USB ports on city computers are disabled.

[MPMalloy]

From BI: What would happen if America's Internet went Down

[MPMalloy]

From US-CERT/CISA, via an email: Vulnerabilities in Multiple VPN Applications

This report lists three VPN's. I think I've heard of one of them. None of the 'big names'.

[Stercutus]

I made myself younger, liberal and female.

Tired of seeing all the ads and clickbait to help me with planning for my retirement as well as for stair lifts and reverse mortgage calculators I decided to answer a few MS polls and answered as best I could. That got hamster wheels turning. Now I get ads inviting me as a millennial to transgender days at Disney and how to do conflict resolution with my husband (hint: he is always wrong).


I'm trying to figure out what to do next. I don't really want to change my ethnic background or race but I was thinking about going ESL, just not sure which language to pick.

[flybynight]

About an hour ago I got this sketchy txt from Chase Fraud asking me to reply if I used my card for $1.50 at a fast food restaurant. I figured it was some kind of phishing scam , but checked my account and saw no 1.50 charge. The txt though specified the last four digits of my card though which was concerning. So I called the debit card number. Long story short. Yes it was Chase Fraud txtn. Yes someone tried to use my card number for $1.50 in Texas and yes my card is now deactivated. F@#$%&*

[SCBrian]

A lot of times, fraudsters will use small transactions 1-5$ to "test" a card before a major transaction.
My wife gets alerts on her phone anytime our card is used in addition to hard upper limits on the amount. She can change it near instantly for big purchases.

[MPMalloy]

From CNBC: Alarm in Texas as 23 towns hit by ‘coordinated’ ransomware attack

[MPMalloy]

From BleepingComputer: Hackers Use Fake NordVPN Website to Deliver Banking Trojan

[SCBrian]

Anyone running a linux box and using webmin as a GUI needs to make sure they are on the most current version (1.93).

https://threatpost.com/backdoor-found-i ... ux/147581/

The backdoor gave anyone with knowledge of its existence the ability to execute commands as root, meaning an attacker could take control of the targeted endpoint. According to Jamie Cameron, the author of Webmin, the bogus version was 1.890. Two additional versions were found with near identical backdoor code, version 1.900 and 1.920.

I know some of you folks are like me and run media servers, etc. so check your stuff...

[Stercutus]

I did a "Mylife" search on myself and apparently I suck. My home is only worth $382, my net worth is pitiable, my annual income less than a 1/3 what I thought it was. I have a criminal record I did not know about and I am still driving the 8 year old Jetta I sold back in 2015. My close family members and associates are people I don't really know and the reason I have not been getting many phone calls lately is because my phone number is wrong.

In other words everything is going according to plan.

https://www.mylife.com/

[MPMalloy]

The Extortion Economy: How Insurance Companies Are Fueling a Rise in Ransomware Attacks

[MPMalloy]

From CIS, via an email: Multiple Vulnerabilities in PHP Could Allow for Arbitrary Code Execution

Current Stable PHP 7.3.9

[MPMalloy]

From DHS - U.S. CERT: HIDDEN COBRA - North Korean Malicious Cyber Activity

[MPMalloy]

From The CISA: 2019 CWE Top 25 Most Dangerous Software Errors