Pete Recommends – Weekly highlights on cyber security issues, March 18, 2023

Subject: 9 Tips to Protect Your Smartphone from Hackers
Source: gHacks Tech News
https://www.ghacks.net/2023/03/11/9-tips-to-protect-your-mobile-data-security-from-hackers/

When considering the term “hackers,” the common perception is often of individuals seeking unauthorized access to computers to obtain passwords, steal identities, or cause general disruption. However, it is important to note that smartphones are also potential targets for these cyber threats, putting sensitive information at risk. Even with heightened precautions, the use of a Virtual Private Network (VPN) remains an advisable course of action to ensure security.

It is crucial to recognize the potential dangers of data breaches, as evidenced by recent incidents such as the Pegasus scandal. In these instances, cybercriminals may gain access to personal calls or messages, track location data, and even remotely activate microphones or cameras from any corner of the globe.

As the availability and usage of spyware tools expand among both authoritarian regimes and ordinary individuals, the need to safeguard personal mobile devices against potential hacks is paramount. It is crucial to maintain good digital hygiene practices and be equipped with knowledge to secure one’s smartphone defenses, as well as knowing how to recognize signs of a possible hack.

This article seeks to provide comprehensive guidance on two key areas. Firstly, preventative measures to stop unauthorized access to mobile data, and secondly, a step-by-step guide on what actions to take if a hack is suspected or confirmed.

…

Filed: https://www.ghacks.net/category/software/security/

Subject: AT&T data breach hits nine million customer accounts
Source: Android Central
https://www.androidcentral.com/phones/carriers/atandt-data-breach-affects-9-million-customers

What you need to know:

  • AT&T has confirmed that some nine million customer accounts have been exposed after a third-party marketing vendor has been hacked.
  • Customer information such as first names, account numbers, phone numbers, and email addresses were compromised as a result of the data breach.
  • AT&T’s own systems were not affected by the breach, nonetheless.

The massive security breach impacted approximately nine million customer accounts, and it took place in January, the same month that T-Mobile suffered a massive data breach affecting approximately 37 million postpaid and prepaid accounts.

Additionally, personally identifiable information such as first names, wireless account numbers, wireless phone numbers, and email addresses were exposed.

Subject: New algorithm may change the future of secure communication
Source: Help Net Security
https://www.helpnetsecurity.com/2023/03/13/secure-communication-algorithm/

Researchers have made a significant breakthrough in secure communication by developing an algorithm that conceals sensitive information so effectively that it is impossible to detect anything hidden. The team, led by the University of Oxford in close collaboration with Carnegie Mellon University, envisages that this method may soon be used widely in digital human communications, including social media and private messaging. In particular, the ability to send perfectly secure information may empower vulnerable groups, such as dissidents, investigative journalists, and humanitarian aid workers.

Steganography vs cryptography – The algorithm applies to a setting called steganography: the practice of hiding sensitive information inside of innocuous content. Steganography differs from cryptography because the sensitive information is concealed in such a way that obscures the fact that something has been hidden. An example could be hiding a Shakespeare poem inside an AI-generated cat image.

Despite having been studied for more than 25 years, existing steganography approaches generally have imperfect security, meaning that individuals who use these methods risk being detected. This is because previous steganography algorithms would subtly change the distribution of innocuous content.

…

More about:
Subject: ViLE Gang Members Charged With Hacking Federal Data Portal
Source: Gizmodo
https://gizmodo.com/vile-gang-hackers-dea-data-portal-subpoena-data-1850226656

Last year, cybercriminals started using a novel tactic to pilfer subscriber data from social media companies: using stolen passwords purchased on the dark web, digital hoods would hack into police email accounts, then use their access to file something called an emergency data request, or EDR. A type of urgent subpoena that requires no court authorization or broader company review, EDRs are filed by police agencies to social media firms with relative frequency, and law enforcement encourages the companies to turn over subscriber information on particular users quickly. Using information from EDRs, the hackers would carry out campaigns of harassment against users.Now, two people allegedly involved in one such scheme have been arrested.

…

Filed: https://gizmodo.com/tech/privacy-and-security

Subject: NSA offers new tips on zero trust and identity
Source: FCW
https://fcw.com/security/2023/03/nsa-offers-new-insights-zero-trust-and-identity/384023/

Weaknesses in identity and access controls are allowing cyber attacks to happen, NSA officials say. A new tip sheet is meant to help national security systems mature their controls.The National Security Agency has new recommendations on identity, credential and access management security controls and their role in zero trust architecture.

The cybersecurity information sheet, released Tuesday, builds on previous NSA guidance on zero trust with more specifics for what it calls the “user pillar” focused on managing access.

Although the information is intended for owners and operators of national security systems — including defense and intelligence agencies, but also contractors in the space — zero trust has been a cybersecurity focus for federal agencies since at least the beginning of the Biden administration.

The White House defined zero trust as an architecture that “requires continuous verification of the operational picture via real-time information” in the order, meaning establishing IT systems that both monitor user behavior on networks and segment access in an effort to mitigate potential cyber attacks.

Subject: EFFector 35.3
Source: Electronic Frontier Foundation
https://www.eff.org/effector/35/3

Top Features

Coded Resistance, the Comic! From the days of chattel slavery until the modern Black Lives Matter movement, Black communities have developed innovative ways to fight back against oppression. EFF’s Director of Engineering, Alexis Hancock, documented this important history of codes, ciphers, underground telecommunications and dance in a blog post that became one of our favorite articles of 2021. In collaboration with The Nib and illustrator Chelsea Saunders, we now have adapted “Coded Resistance” into comic form to further explore these stories, from the coded songs of Harriet Tubman to Darnella Frazier recording the murder of George Floyd.
Subject: Beware of Bank-Related Scams
Source: CISA
https://www.cisa.gov/news-events/alerts/2023/03/15/beware-bank-related-scams

Release Date

In light of recent bank failures, CISA warns consumers to beware of potential scams requesting your money or sensitive personal information. Exercise caution in handling emails with bank-related subject lines, attachments, or links. In addition, be wary of social media pleas, texts, or door-to-door solicitations relating to any failed bank.

The Federal Deposit Insurance Corporation (FDIC), the “Receiver” of failed banks, would never contact you asking for personal details, such as bank account information, credit and debit card numbers, social security numbers, or passwords.

To avoid becoming victims of scams, consumers should review the following resources and take preventative measures:

Consider reporting scams and fraud to the police and file a report with the Federal Trade Commission.

Subject: Convincing Twitter ‘quote tweet’ phone scam targets bank customers
Source: Bleeping Computer
https://www.bleepingcomputer.com/news/security/convincing-twitter-quote-tweet-phone-scam-targets-bank-customers/

A convincing Twitter scam is targeting bank customers by abusing the quote-tweet feature, as observed by BleepingComputer.What makes this scam stand out is it preys on customers tweeting to their banks—such as to raise a complaint or request assistance. But these customers instead receive a reply from the scammer, via a quote-tweet, luring them to call the scammer’s “helpline” number.

The scam’s simplicity and focused targeting makes it convincing to unsuspecting users.

Fake bank Twitter accounts luring customers in – Users tagging Twitter accounts of their banks in their tweets—for example, when raising complaints about an issue, should watch out for responses from non-verified Twitter accounts that may closely be impersonating the bank’s support staff and instead be a scam.

Moreover, what makes this scam particularly interesting is, the fact that genuine companies sometimes choose to reply via a separate Twitter account, different from their corporate (verified) one, for tweets which are akin to support requests.

…

Tags:

Subject: FCC Adopts New Rules to Block Unwanted Robotexts and Robocalls
Source: Phone Scoop
https://www.phonescoop.com/articles/article.php?a=22978

The FCC today formally adopted multiple new rules to fight spam and scam calls and texts. Wireless carriers will now be required to actively block text messages “that are highly likely to be illegal”, including ones from phone numbers that cannot or do not send text messages. Another new FCC rule requires additional telecom companies to implement STIR/SHAKEN, the authentication system intended to fight spoofed caller-ID schemes that enable illegal robocalling. Additionally, all telecom providers “will now be required to take ‘reasonable steps’ to mitigate illegal robocall traffic”.[Anyone recall the recent Conservatives vs. Gmail anti-spam controversy? good luck w/ that /pmw1]

Subject: Can chatbots remember what you type? NCSC issues warning
Source: TechHQ
https://www.bespacific.com/can-chatbots-remember-what-you-type-ncsc-issues-warning/

TechHQ: “Being careful with whom you share your secrets is always good advice. And that tip applies to advanced chatbots such as OpenAI’s ChatGPT. In fairness, OpenAI does provide user guidelines in its FAQs. “We are not able to delete specific prompts from your history,” writes the developer. “Please don’t share any sensitive information in your conversations.” The advice comes 8th on the list and, a few bullet points earlier, OpenAI mentions that it reviews conversations between ChatGPT and users to improve its systems and to ensure the content complies with the company’s policies and safety requirements.”

TechHQ tagged:https://techhq.com/tag/artificial-intelligence/

RSS: https://techhq.com/tag/artificial-intelligence/feed/

—

Abstracted from beSpacific
Copyright © 2023 beSpacific, All rights reserved.

Subject: FDIC fails to establish effective controls to secure sensitive data, report says
Source: FCW
https://fcw.com/digital-government/2023/03/fdic-fails-establish-effective-controls-secure-sensitive-data-report-says/384097/

The agency tasked with supervising financial institutions nationwide is struggling to maintain effective information security measures, according to a new inspector general report.The Federal Deposit Insurance Corporation has failed to establish effective controls to secure and maintain the data access infrastructure overseeing the agency’s information systems, according to a new report.

The FDIC Office of Inspector General report published Wednesday said the failure, centered on its Active Directory service, leaves the agency’s information systems susceptible to intrusions from malicious actors and cybercriminals seeking sensitive data.

The agency tasked with supervising financial institutions and protecting bank customers nationwide has meanwhile struggled for years to improve its information security controls, with previous reports also citing a similar lack of authorization controls.

The Active Directory service, developed by Microsoft, oversees centralized system access on a network, allowing administrators to control user privileges to certain components while enforcing security policies. Within FDIC, the chief information officer organization is responsible for AD operations ranging from adding and removing user access to applying configuration changes.

The report said FDIC’s AD infrastructure is an “attractive target” for malicious actors since attackers can potentially “obtain, manipulate, or delete data across the network, causing serious damage to the FDIC and its mission and reputation.”

The FDIC isn’t the only agency facing password management challenges, however. A recent report from the cybersecurity firm SpyCloud found that many federal employees continued to practice poor cyber hygiene last year despite a major push from the White House and the Cybersecurity and Infrastructure Security Agency to bolster federal cybersecurity.

…

Filed: https://fcw.com/digital-government/

RSS: https://fcw.com/rss/digital-government/

Subject: Lurking Beneath the Surface: Hidden Impacts of Pixel Tracking
Source: FTC
https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2023/03/lurking-beneath-surface-hidden-impacts-pixel-tracking

The Federal Trade Commission recently took enforcement action against GoodRx[1] and BetterHelp[2], two digital healthcare platforms, for allegedly sharing user health data with third parties for advertising. Both cases highlighted the use of third-party tracking pixels, which enable platforms to amass, analyze, and infer information about user activity.[3] The remedies in GoodRx[4] and BetterHelp[5] include strong provisions like bans that place strict, comprehensive limits on whether and how certain user information may be disclosed for advertising. In GoodRx and BetterHelp, this included a ban on the sharing of health information for any advertising purposes, and the BetterHelp order further bans the disclosure of other personal information for re-targeting.What is pixel tracking?

Tracking pixels have evolved from tiny, pixel-sized images on web pages for tracking purposes to include a broad range of HTML and JavaScript embedded in web sites (and email).[6] Tracking pixels can be hidden from sight and can track and send all sorts of personal data such as how a user interacts with a web page including specific items a user has purchased or information users have typed within a form while on the site.[7] Businesses often want to use them to track consumer behavior (pageviews, clicks, interactions with ads) and target ads to users who may be more likely to engage or purchase something based on that prior online behavior.[8]
Filed: https://www.ftc.gov/policy/advocacy-research/tech-at-ftc

Subject: SVB account holders targeted with phishing, scams
Source: Help Net Security
https://www.helpnetsecurity.com/2023/03/17/svb-account-holders-phishing-scams/

After news broke late last week about Silicon Valley Bank’s bank run and collapse, security researchers started warning SVB account holders about incoming SVB-related scams and phishing attempts.

New domain registrations relating to Silicon Valley Bank are emerging. Some could be #phishing campaigns. Listed below is what we’re seeing now. Keep in mind not all are scammy, and not all scammy domains targeting SVB will have SVB-related terms: https://t.co/mHjfZQIQAf pic.twitter.com/Au7AbA0GhX

Proofpoint researchers flagged a campaign using messages supposedly coming from several cryptocurrency brands, trying to trick users into installing a Smart Contract that would transfer the contents of their wallet to the attacker’s wallet.

“Once Circle announced they had cash reserves in SVB, the threat actor started spoofing the fintech company, using a lure that promised the victim could redeem USDC to USD at 1:1 rate,” they noted.

Then there’s this email campaign spotted by INKY…

More about:
LinkedIn
Posted in: Cybercrime, Cybersecurity, Economy, Email Security, Financial System, Legal Research, Privacy, Social Media
➤