Showing posts with label email. Show all posts

Equifax Breach Advisory

by Neal Fisch in attacks, awareness, cloud, data security, email, faculty, passwords, personal security, phishing scams, privacy, security, social networking, spear phishing attack, staff, students, tips 0

Given the recent announcement regarding the data exposure at Equifax we wanted to share some good “cyber hygiene” and some resources with you. With 143 million U.S. consumers affected it’s a good chance many of us are impacted.

Equifax has said there is no evidence of unauthorized activity in their credit reporting data bases but that there was potentially unauthorized access to information it stored from mid-May to July of this year. That information included social security number (SSN), dates of birth (DOB), addresses and in some cases Driver’s License numbers. Also reported is that approximately 209,000 consumers credit card numbers were exposed as well as other “dispute documents” for 182,000 consumers.

What can you do?

One of the first things typically suggested after a breach is to access credit reporting agencies and request your records to be sure there are no unauthorized accounts or charges. In this case you may want to consider the other agencies, Experian and TransUnion. Also check your online and credit card accounts for suspicious activity. You can check free credit reports from annualcreditreport.com. Check for any accounts or charges you don't recognize.
Be extra wary of scam emails and links. Avoid clicking on links or downloading attachments from suspicious emails. Equifax will send paper mail to consumersbut hackers are sure to use this to conduct Phishing campaigns.
Change your passwords, especially if you have/had an account with Equifax and use similar or the same password elsewhere.
You can check at Equifax here to get information and to check and see if your records are impacted. You can also access your Equifax credit report here which is probably a good idea so you can compare with the ones you get from Experian and/or TransUnion.

Additional Information:

1 Million GMail Users Impacted by Google Docs Phishing Attack

by Neal Fisch in attacks, awareness, data security, email, faculty, news, personal security, phishing scams, security, social networking, spyware scams, staff, students 0

Reported from ThreatPost May 4, 2017

Google said that up to 1 million Gmail users were victimized by yesterday’s Google Docs phishing scam that spread quickly for a short period of time.

In a statement, Google said that fewer than 0.1 percent of Gmail users were affected; as of last February, Google said it had one billion active Gmail users.

Google took measures to protect its users by disabling offending accounts, and removing phony pages and malicious applications involved in the attacks. Other security measures were pushed out in updates to Gmail, Safe Browsing and other in-house systems.

Additional information by ThreatPost can be found here or on CI's Information Security web site.

Is the IRS really calling/emailing/texting me?

by Neal Fisch in attacks, awareness, counterfeit websites, data security, email, faculty, holiday scams, passwords, personal security, phishing scams, privacy, security, social networking, staff, students, tips, vishing 0

Just like clockwork it happens every year around April. No, I’m not talking about April Fool’s Day or the annual appearance of the Easter Bunny. I’m talking about IRS tax scams.

Every year during the months of February through April tax scammers focus their sights on us whether, at work or at home, and attempt to solicit us to offer up personally identifiable information (PII) such as social security numbers and/or birthdates, or attempt to convince us to send them money directly via credit card or wire transfer.

Some tax scams occur when fraudulent tax returns are filed in the target’s name while other variants occur when the malicious actors call the target and pretend to be Internal Revenue Service (IRS) agents. In addition, there are malicious actors who use the tax season to spread malware and phishing emails.

Of these various types of tax scams, in one type, a return is filed in the victim’s name include identity theft, identity fraud, and tax fraud. This scenario occurs when the malicious actor uses information about the tax filer such as their name, address, date of birth, and Social Security Number to file a false tax return as the target claiming as many deductions as they can to gain the largest refund amount.

In a second type of tax scam, the malicious actor contacts the target by phone and tries to convince the target to do something, such as immediately paying a fine or providing their financial information so a refund can be issued. In these instances, the malicious actor uses what they know about the victim, often information gained from a previously occurred data breach or social networking website, to convince the victim that the caller has access to the victim’s tax information. Frequently during these calls the caller will pretend to be an IRS agent.

In the third type of tax scam, malicious actors use tax related spam, phishing emails, and fraudulent websites to trick victims into providing login names, passwords, or additional information, which can be used in further fraud. Other emails or websites may download malware onto the victim’s computer.

Some things you should look out for:

Look for “spoofed” (copied) websites that look like the official website but are not.
Don’t be fooled by unsolicited calls. The IRS will never contact you by phone, email, text or social media, and the IRS will never demand an immediate payment or require you to use a specific payment method such as pre-loaded debit or credit cards, or wire transfers. They will never claim anything is “urgent” or due immediately, nor will they request payment over the phone.
The IRS will not be hostile, insulting, or threatening, nor will they threaten to involve law enforcement in order to have you arrested or deported.
Sometimes malicious actors change their Caller ID to say they are the IRS. If you’re not sure, ask for the agent’s name, hang up, and call the IRS (or your state tax agency) back using a phone number from their official website.

Recommendations

If you believe you are the victim of identity theft or identity fraud, there are a couple of steps you should take:

File a report with your local law enforcement agency.
File a report with the Federal Trade Commission (FTC) at www.identitytheft.gov.
File a report with the three major credit bureaus and request a “fraud alert” for your account (Equifax – www.equifax.com, Experian – www.experian.com, TransUnion – www.transunion.com).

If you receive any spam or a phishing email about your taxes, do not click on the links or open any attachments, instead forward the email to phishing@irs.gov. Other tax scams or frauds can be reported according to the directions on these pages referenced below:

References:

IRS Tax Scams and Consumer Alerts: https://www.irs.gov/uac/tax-scams-consumer-alerts
IRS Tax Fraud Alerts: https://www.irs.gov/uac/tax-fraud-alerts
IRS Report Phishing and Online SCAMS: https://www.irs.gov/uac/report-phishing
IRS Security Awareness for Taxpayers: https://www.irs.gov/pub/irs-pdf/p4524.pdf

Cyber Essentials - I'm Hacked, Now What?

by Neal Fisch in attacks, awareness, data cleanup, data security, email, faculty, personal security, phishing scams, security, staff, students, tips 0

Continuing our blog series targeted at protecting yourself against cyber threats, today's blog topic covers Cyber Bullying.

Today's guest blog contributor is Eric Varela. Eric is a student here at CSU Channel Islands majoring in Information Technology with a minor in Security Systems Engineering.

Define Hacked: No matter how securely you use technology in your day-to-day life, you may eventually be hacked or more commonly called “compromised.” In this blog, you will learn how to determine if your mobile device or computer has been hacked and, if so, what you can do in response. Bottom line, the quicker you detect something is wrong and the faster you respond, the more likely you can reduce the harm a cyber-attacker can cause.

Clues You Have Been Compromised: It can be difficult to determine if you have been compromised, as there is often no single way you can figure it out. On the other hand, hackers usually leave behind several clues, often called ‘indicators’. The closer your system matches any of these indicators, the more likely it has been compromised:

Your anti-virus program has flagged an alert that your system is infected, specifically if it says that it was unable to remove or quarantine the affected files.
Your web browser’s homepage has unexpectedly changed or your browser is taking you to websites that you did not want to go to.
There are new accounts on your computer or mobile device that you did not create, or new programs running that you did not download and install.
Your computer or applications are constantly crashing, there are icons for unknown apps on your mobile device, or strange windows keep popping up.
A program requests your authorization to make changes to your system, though you’re not installing or updating any of your applications.
Your password no longer works when you try to log into your system or an online account, even though you know your password is correct.
Your friends ask you why you are spamming them with emails that you know you never sent.

How to Respond: If you believe your computer or mobile device has been compromised, the sooner you respond the better. Here are some steps you can take:

Anti-Virus: If your anti-virus software informs you of an infected file, you can follow the actions it recommends (delete, quarantine, etc.). (Note: Most anti-virus software will have links you can follow to learn more about the specific infection.)
Change your passwords: This includes not only changing the passwords on your computers and mobile devices, but for all of your online accounts. Be sure you do not use the compromised computer to change the passwords. Alternatively, use a different computer or device that you know is secure to change the passwords.
Rebuilding: If you are unable to fix the infection or you want to be absolutely sure your system is fixed, a more secure option is to rebuild (reformat) it. Follow your system manufacturer’s instructions. In most cases, this will mean using the built-in utilities to reinstall the operating system. (Tip: If these utilities are missing, corrupted, or infected, then contact your manufacturer for guidance or visit their website.)
Backups: The most important step you can take to protecting yourself is to prepare ahead of time with regular backups. (Tip: The more often you back up, the better. Often times, recovering your data from a backup is the only way you can recover from being hacked.)

Derived from sans.org

New PayPal phishing scam hooking victims

by Neal Fisch in attacks, awareness, counterfeit websites, data security, email, faculty, news, personal security, phishing scams, security, social networking, spear phishing attack, staff, students, tips 0

With Phishing and Spearphishing on the rise people need to pay close attention to the email they receive. The research firm AppRiver is reported a new PayPal phishing scam is making the rounds with this version using a phony security message to obtain personal identifiable information.

Additional information about phishing can be found at here.

The full article may be found here at SC Magazine.

Protect Yourself Against Cyber Threats - Mobile Devices

by Neal Fisch in attacks, awareness, cloud, counterfeit websites, data security, devices, email, faculty, holiday scams, newsletter, passwords, personal security, phishing scams, security, social networking, staff, students, tips 0

Continuing our blog series targeted at protecting yourself against cyber threats, today's blog topic covers Mobile Devices.

Today's guest blog contributor is Eric Varela. Eric is a student here at CSU Channel Islands majoring in Information Technology with a minor in Security Systems Engineering.

What is a “Mobile Device”?

The term “Mobile Device” gets thrown around for anything from a smartphone to a tablet, and while that classification is true, mobile devices encompass items such as Laptops, Chromebooks, “smart watches” (Apple Watch), “smart appliances” (refrigerators, washing machines), and even “smart thermostats” (Nest). Thanks largely in part to technology that allows computer processors, graphics processing, and memory to be the size of a quarter, powerful computing capabilities can be found almost anywhere and in the most mundane of places.

Keep a Clean Mobile Machine:

Mobile devices are computers at their core with software that needs to be kept up-to-date (just like your desktop PC). Security protections are built in and updated on a regular basis. (Tip: Take time to make sure all the mobile devices in your home have the latest protections).

Suspect Links and Texts:

Be suspicious of unknown links or requests sent through email or text message. Do not click on unknown links or answer strange questions sent to your mobile device, regardless of who the sender appears to be, as some links are designed to gather your personal information.

Be Careful What You Download:

Download only trusted applications from reputable sources or marketplaces, as some apps may install harmful code onto your device (malware).

Secure Your Phone: Use a strong passcode and lock your phone.
Think Before you App: Review the privacy policy and understand what data (location, access to your social networks) the app can access on your device before you download.

Protect Your Personal Information:

Phones can contain tremendous amounts of personal information. Lost or stolen devices can be used to gather information about you, and potentially, others. Protect your phone like you would your computer. (Tip: Only give your mobile number out to people you know and trust and never give anyone else’s number out without their permission).

Connect with Care:

Use common sense when you connect. If you’re online through an unsecured or unprotected network, be cautious about the sites you visit and the information you release.

Get Savvy about Wi-Fi Hotspots: Limit the type of business you conduct and adjust the security settings on your device to limit who can access your phone.
Protect your $: When banking or shopping, check to be sure the site is security enabled. (Tip: Look for web addresses with “https://” or “shttp://”, which means the site takes extra measures to help secure your information.
When in Doubt, Don’t Respond: Fraudulent texting, calling and voicemails are on the rise. Just like email, requests for personal information or for immediate action are almost always a scam.

Derived from NICCS and StaySafe Online

Tax Identity Theft Awareness Week Begins Today!

by Neal Fisch in attacks, awareness, cloud, counterfeit websites, data security, email, faculty, holiday scams, passwords, personal security, phishing scams, security, social networking, spear phishing attack, staff, students, tips 0

Two Ways Tax Scammers Might Target You

It’s that time of year — tax time. It’s also a great time to get up to speed on tax-related scams. Here are two ways tax scammers might target you:

Tax identity theft

This kind of identity theft happens when someone files a fake tax return using your personal information — like your Social Security number — to get a tax refund or a job. You find out about it when you get a letter from the IRS saying:

more than one tax return was filed in your name, or
IRS records show wages from an employer you don’t know

If you get a letter like this, contact the IRS Identity Protection Specialized Unit at 800-908-4490. You can find more about tax identity theft at ftc.gov/taxidtheft and irs.gov/identitytheft.

IRS imposter scams

This time scammers aren’t pretending to be you — they’re posing as the IRS. They call you up saying you owe taxes, and threaten to arrest you if you don’t pay right away. They might know all or part of your Social Security number, and they can rig caller ID to make it look like the call is coming from Washington, DC – when it could be coming from anywhere. Leaving you no time to think, they tell you to put the money on a prepaid debit card and tell them the card number right away.

The real IRS won’t ask you to pay with prepaid debit cards or wire transfers, and won’t ask for a credit card number over the phone. When the IRS contacts people about unpaid taxes, they usually do it by mail.

If you have a question about your taxes, call the IRS at 800-829-1040 or go to irs.gov. You can report IRS imposter scams to the Treasury Inspector General for Tax Administration (TIGTA) online or at 800-366-4484, and to the FTC at ftc.gov/complaint.

Social Engineering: The Basics

by Neal Fisch in attacks, awareness, counterfeit websites, data security, email, faculty, holiday scams, news, passwords, personal security, phishing scams, security, social networking, spear phishing attack, staff, students, tips 0

What is social engineering? What are some of the most common tactics used. Here's a short guide on how you lessen your likelihood of becoming a social engineering statistic.

Don't be Duped by Internet Fraud

by Neal Fisch in awareness, counterfeit websites, data security, email, faculty, personal security, phishing scams, security, social networking, spear phishing attack, staff, students, tips 0

We all get offers that seem too good to be true. Whether they come by email or appear on web sites, they are often clever schemes designed to dupe the gullible. Don't be tricked by Internet Fraud. For more information see http://www.lookstoogoodtobetrue.com.

Fake Dropbox login page nabs credentials, is hosted on Dropbox

by Neal Fisch in attacks, awareness, counterfeit websites, data security, email, faculty, news, personal security, phishing scams, security, social networking, staff, students, tips 0

An email with the subject “important” tells recipients that they must sign into Dropbox in order to view a document too big to be sent via regular email, but clicking on the link included in the message brings people to a fake Dropbox login page that is actually hosted on Dropbox.

Link to the rest of this SC Magazine article to find out more about this new scam.

Use a password in only one place.

by Neal Fisch in awareness, cloud, counterfeit websites, data security, email, faculty, passwords, personal security, phishing scams, security, staff, students, tips 0

Reusing passwords or using the same password all over the place is like carrying one key that unlocks your house, your car, your office, your briefcase, and your safety deposit box. If you reuse passwords for more than one computer, account, website, or other secure system, keep in mind that all of those computers, accounts, websites and secure systems will be only as secure as the least secure system on which you have used that password. Don't enter your password on untrusted systems. One lost key could let a thief unlock all the doors. Remember: Change your passwords on a schedule to keep them fresh.

NSA, Net Neutrality Fears Overshadow Senate Cybersecurity Vote

by Neal Fisch in awareness, data security, email, encryption, faculty, personal security, security, social networking, staff, students 0

The Senate Intelligence Committee will vote Tuesday on a bill that would allow companies to share information about digital threats, but the legislation faces potential roadblocks over concerns it could boost surveillance efforts and endanger net neutrality. Additional information can be found here.

Are you emailing sensitive information? If so, beware... This could happen to you!

by Neal Fisch in awareness, data security, email, encryption, faculty, personal security, security, staff, students, tips, vulnerabilities 0

It's inevitable that at some point at a college or university a request for sensitive data will be made to the owning department for a research project, a cross departmental project, or even a report to upper management. All of these scenarios are common and acceptable requests, however, the method used to transmit or share the requested confidential data is critical to the safety and security of that data. Here is an example of using an incorrect transmission method and the repercussions that followed.

Sharing of confidential information is an acceptable practice provided the following safeguards are used:

Approval of the data owning department is given (preferably in writing).
A secure, encrypted transmission method is setup to send and receive the data.
Communication! If you're unsure transmitting this data is appropriate or safe contact your security team.

Following these steps at a minimum will save you from many headaches and heartaches later.

Computer Security and You.

by Neal Fisch in attacks, awareness, data security, email, faculty, passwords, personal security, phishing scams, security, social networking, spear phishing attack, staff, students, tips, virus 0

Scammers, hackers, and identity thieves are looking to steal your personal information – and your money. But there are steps you can take to protect yourself, like keeping your computer software up-to-date and giving out your personal information only when you have a good reason.

Visit our friends at OnGuardOnline.gov and see what you can do to better protect yourself and your personal information.

Ransomware Infections on the Rise.

by Neal Fisch in attacks, awareness, counterfeit websites, data security, email, faculty, personal security, phishing scams, security, staff, students, tips 0

In a recent news release by US-CERT, the United States Computer Emergency Readiness Team, US-CERT stated they are aware of a malware campaign that surfaced in 2013 and is associated with an increasing number of ransomware infections. CryptoLocker, a new variant of ransomware, restricts access to infected computers and demands the victim provide a payment to the attackers in order to decrypt and recover their files. As of this time the primary means of infection appears to be phishing emails containing malicious attachments.

Everyone who makes use of computer systems, including email, should be on guard for these types of malware infection attempts. In many cases the email will appear to be legitimate and harmless but you need to ask yourself if you were expecting this communication, and if not, contact the sender to make sure it's legitimate.

To help mitigate any loss of data should you fall victim to this infection, you should take regular backups of your system and store your important files onto your file server which is backed up regularly.

To get more information about CryptoLocker, follow this link to the US_CERT website and think before you click!

October is National Cyber Security Awareness Month

by Neal Fisch in awareness, data security, devices, email, faculty, Peer-to-Peer (P2P), personal security, phishing scams, security, social networking, spear phishing attack, spyware scams, staff, students, tips 0

Each and every one of us needs to do our part to make sure that our online lives are kept safe and secure. That's what National Cyber Security Awareness Month—observed in October —is all about!

Please take the time to review some of our resources available to help you become more aware of the current landscape for cyber-threats.

How to spot a phishing email.

by Neal Fisch in awareness, data security, email, faculty, passwords, personal security, phishing scams, security, social networking, spear phishing attack, staff, students, tips, vishing 0

With the recent flurry of phishing emails being received these days I thought I would post this quick guide to assist you in determining if the email you received may actually be a phishing email.

It could be a phishing email if:

There are misspelled words in the email or it contains poor grammar.
The message is asking for personally identifiable information (PII), such as credit card numbers, account numbers, passwords, PIN's or Social Security Number.
There are "threats" or alarming statements that create a sense of urgency. For example: "Your account will be locked until we hear from you" or "We have noticed activity on your account from a foreign IP address".
The domain name in the message isn't the one you're used to seeing. It's usually close to the real domain name but not exact. For example:

Phishing Website: www.regionsbanking.com
Real Website: www.regions.com

Google Strengthening Keys on SSL Certificates to 2048 Bits

by Neal Fisch in attacks, cloud, data security, email, encryption, passwords, security 0

As attacks against cryptographic systems and the SSL infrastructure have advanced in recent years, experts have begun to fret about the future utility of the system. Companies that rely on the security of the SSL technology are beginning to take steps to address the issue, with the latest being Google, which is planning to change the length of the keys on all of its SSL certificates to 2048 bits.

Follow this link to read the full article from Threatpost.com.

Think Before you Click!

by Neal Fisch in awareness, data security, email, faculty, personal security, phishing scams, security, spear phishing attack, staff, students, tips 0

Be cautious about all communications you receive, and clicking on links in an email, instant message or a website. Even if you know and trust the sender of the email, or an instant message, or are on a known website or a friend's social networking page, it is still prudent to use caution when navigating pages and clicking on links or photos, because links, images or other content contained on the pages may include malicious code placed there by hackers.

For more information, please visit:
SANS OUCH! Newsletter on "Email Phishing Attacks"

Don't Reply to Unsolicited Email Messages (SPAM).

by Neal Fisch in awareness, counterfeit websites, data security, email, faculty, passwords, personal security, security, spear phishing attack, staff, students, tips 0

By responding to these messages, you're only confirming that your email address is active. Another thing you shouldn't do is click the "remove me" link in the message. Links in email can point to an IP address other than what is being represented or referenced. The best thing you can do is delete the message.

Many free email service providers (MSN hotmail, Yahoo!, AOL or GMail) will allow you to easily report it as spam if you received it through their email systems.