securewebsite

As always, you must be suspicious of all email attachments, because attackers are finding new ways to get around email security filters. The latest attack includes Microsoft Office attachments containing hyperlinks to dangerous websites.

If you unknowingly download one of these attachments and click on a link from within the document, you will be brought to a malicious website that steals your sensitive information. This particular attack is usually carried out with Microsoft Word attachments, but dangerous links are certainly not limited to files with .docx file extensions. This attack could occur with almost any file type.

Always remember the following to prevent this type of attack from happening to you:

• Never open attachments from people you don’t know.
• Don’t open any attachment unless you have asked for it, or have verified with the sender (through a channel other than email) that it is legitimate.
• Before clicking any link within an email or an email attachment, hover over it to see where it will take you.

Stop, Look, and Think. Don’t be fooled.

Dunkin’ Donuts: One of the world’s leading baked goods and coffee chains

Risk to Small Business: Severe: On February 12th, Dunkin’ Donuts announced that it suffered a credential stuffing attack back in January. This news comes just a few months after the company fell victim to a similar attack on October 31, 2018. As we’ve covered before, hackers employ credential stuffing attacks by leveraging previously leaked usernames and passwords to access user accounts. In this case, they were able to breach DD Perks rewards accounts and are putting them up for sale on Dark Web forums. Aside for the “double whammy” of two attacks within a short time-frame, loyal customers who have lost their rewards will likely bring their business elsewhere.

Individual Risk: Moderate: The exposed accounts contain personal information such as first and last names, email addresses, 16-digit account numbers, and QR codes. Although the accounts have been put up for sale so that buyers on the Dark Web can cash out on reward points, they can also use credentials to orchestrate further cyberattacks.

Customers Impacted: 12,000

How it Could Affect Your Customers’ Business: The trend of credential stuffing is only the first wave resulting from billions of recently leaked usernames and passwords. Companies that experience similar attacks on user accounts will be held liable, regardless of whether they are the source of the breach. To protect from future attacks, businesses must team up with security providers to ensure state-of-the-art password protection and Dark Web monitoring.

Read more

In Other News: MyFitnessPal and CoffeeMeetsBagel data go for sale on the Dark Web

After the breach of MyFitnessPal last year involving 150M user accounts, the data has finally been packaged up along with stolen credentials from 15 other websites to be sold on the Dark Web. The asking price? Less than $20,000 in Bitcoin.Other websites included are CoffeeMeetsBagel, Dubsmash, MyHeritage, ShareThis, HauteLook, Animoto, EyeEm, 8fit, Whitepages, Fotolog, 500px, Armor Games, BookMate, Artsy, and DataCamp. In total, 617 million compromised records are involved.

Cybercriminals can combine such databases to find users who are recycling passwords across multiple sites, allowing them to hack into valuable accounts that can be leveraged for fraud. By investing in solutions that can consistently monitor the Dark Web, companies can quickly understand how hackers are planning to use exposed information and implement cybersecurity safeguards. 

Read more

Nowadays, you should be on high alert whenever you’re browsing the web. The cyber scammers are counting on you to have an average (or below-average) level of knowledge about cybersecurity threats so they can trick you into downloading malicious applications.

The attack usually goes like this: First, you receive a fake Windows Alert pop-up message claiming “Your PC might be infected” and to “click OK to do a quick 10-second scan”.

When you click OK, a very realistic-looking–but very fake–”system scan” runs within your browser. The scan looks almost identical to your antivirus software’s real system scans.

Once the “scan” ends, you’re told that your PC is indeed infected and that you need to download and install an update to the antivirus software. Don’t do it! This “update” is actually an unwanted application that will install onto your computer.

Consider the following to protect yourself from this type of scam:

• Never trust internet pop-ups. They often use scare tactics to get you to call a number for tech support or download an application to “fix” the problem.
• Go to your IT administrator (if at work) or a reputable computer repair company (if at home) if you think something is wrong with your computer.

Stay safe out there!

Stop, Look, and Think. Don’t be fooled.

Trakt: Media service for “scrobbling,” or tracking movies and shows watched online

Risk to Small Business: Severe: The California-based media platform emailed its customers notifying them of a breach that took place over 4 years ago, in December of 2014. In their statement, they claimed that they only recently discovered the breach, and took steps to mitigate it since. Payment information was not disclosed, but usernames, emails, passwords, names, and locations were. The investigation is ongoing, but the only risk at this point seems to be that of customer attrition.

Individual Risk: Moderate: The company seems to have inadvertently mitigated the breach, migrating to a more secure version of its website in January 2015. However, users that have recycled passwords between accounts should be wary.

How it Could Affect Your Customers’ Business: Even without involving payment data, breaches that trace back multiple years can unnerve end-users into deleting their accounts forever. When they receive an email notifying them that a breach from 2014 was just now discovered, they are likely to weigh other options or stop using the service entirely. In a world where competition is cutthroat and the customer has more information and choices at their fingertips than ever before, businesses must do everything in their power to retain and build trust.

Read more

————————————————————————————————————

In Other News:

How to save your IT system from its own users: Zero Trust Browsing

2017: The Year of Cryptojacking. 2018: The Year of Ransomware. 2019? It’s shaping up to be the Year of Phishing.

Historically, we’ve labeled phishing as a nuisance that only a select few fall for. However, the increasing sophistication of social engineering, along with a gradual evolution of phishing techniques, have leveled the game. For example, hackers have realized the importance we place on SSL certification, and have found ways to exploit it in order to give us a false sense of reassurance. Browsers such as Edge, Chrome, and Firefox have created advanced filtering techniques, but they are still unable to identify 10-25% of phishing sites…

Read more