711 Million Email Addresses Exposed: How to Protect Yourself

/in ,

Typically, your spam folder catches a lot of the malware-infected crud sent by the mischievous never-do-wells from the darker corners of the internet. Unfortunately, a newly discovered attack has targeted more than 711 million email accounts.

Fortunately, only some — not all — of the targets’ passwords have been taken.

The Onliner spambot, first discovered by a Paris-based security researcher who goes by the Benkow pseudonym, was confirmed by well-regarded security expert Troy Hunt in an August 30 blog post. Hunt — a Microsoft Regional Director who runs the breach-tracking website Have I Been Pwned — referred to a data dump from Onliner as “a mind-boggling amount of data,” in which he even found his own email address.

How does Onliner do it?

According to a ZDNet report, the hooligans behind the spambot compiled a massive database of 80 million email credentials from a number of other breaches, such as the LinkedIn hack. These logins were then used to spam 630 million email addresses, whose spam filters they jumped right over.

What can you do?

First, check Have I Been Pwned to see if your email account information is in the hack, Onliner may not have much of your information beyond your address. Onliner worked by sending two rounds of emails, as only a fraction of the 711 million targets could actually be infected by its malware.

If Have I Been Pwned says your email address appeared in the Onliner dump, there are three steps you need to take immediately. The first is changing the password to your email account. Second, make sure you’re not using that password in any other online accounts — especially those for banking. Lastly, enable two-factor authentication, so your email address and password alone aren’t enough for your account to be cracked.

The spambot campaign whittled its target list down by placing a difficult-to-see, pixel-sized image in its initial emails, which contained code to send a user’s IP address and system information back to HQ. If the pixel detected its recipient was a Windows PC (Androids, iOS devices and Macs are protected), it would tell the server to send more-targeted emails — which looked like invoices — to the addresses it identified as vulnerable.

Now’s a good time to look into a password manager, which can help you create strong, hard-to-guess passwords. And of course, do your best to avoid opening suspicious-looking emails, especially those that look like invoices for services you don’t pay for.

The secondary wave of emails is smaller for the sake of obscurity, since larger attacks are more likely to draw the attention of law enforcement and security experts. The infectious emails contain a JavaScript file that does all the dirty work, pwning your machine.

tom's guide

Office 365: A Vehicle for Internal Phishing Attacks

/in

A new threat uses internal accounts to spread phishing attacks, making fraudulent emails even harder to detect.

Cybercriminals go where the users are. Office 365, which has more than 100 million active monthly subscribers, has become a hotspot for compelling and personalized cyberattacks. Users trust emails from coworkers, especially those with the correct corporate email address.

Traditional phishing attempts have red flags: suspicious attachments, bold requests, misspelled words, questionable email addresses. Users know how to react to these. But what happens when attacks are more personalized, with legitimate addresses and reasonable requests?

These have become more popular and tougher to spot, says Asaf Cidon, spearphishing expert at Barracuda. The company recently released a report on a threat he calls Account Compromise. Once they have an employee’s Office 365 account information, threat actors can craft realistic-looking messages and send them from an account their victims trust.

Attackers primarily steal credentials using traditional methods, he continues. Most rely on phishing or spearphishing to send victims to fraudulent websites, where they are prompted to reset their Office 365 credentials. Some buy users’ credentials on the dark web.

“What’s new is what happens after they get access to the accounts,” Cidon says. Threat actors can conduct several types of attacks after they gain a foothold in an organization.

In one common scenario, an attacker sets forwarding rules on an Office 365 account to send emails to an account they control. From there, they can both steal data and monitor the user’s internal and external communication patterns so they can plan future attacks.

Threat actors also impersonate their victims and send emails to other employees with the goal of collecting data. Some send emails with PDF attachments that can only be opened with a username and password. Some send an invoice for payment that requires logging into a web portal, where they have to log in with a corporate email address and password.

Damage could potentially extend outside the organization. Cidon explains a scenario in which an attacker, impersonating an employee, used their access to request a wire transfer from a partner company. The employee in the scenario didn’t even realize the transfer was happening.

“This is an evolution of spearphishing – we’re seeing more and more sophistication,” he says. A couple of years ago, cyberattackers primarily targeted executive employees. These new Office 365 threats are putting all employees at risk.

“With this attack, they’re just trying to get in and once they’re in, a lot of the employees getting targeted are not high-level. It’s not just executive targets,” Cidon continues.

There are red flags that signify a company is targeted in one of these attacks. Oftentimes the IP addresses used to log into corporate accounts come from other countries, he says, and looking at the log can identify geographical anomalies. It also helps to keep track of your email account to see when emails are getting forwarded or sent to unfamiliar addresses.

Cidon advises security leaders to train employees on how to spot phishing attacks to prevent attackers gaining initial access. He also advises adding security layers like multi-factor authentication to Office 365 to lessen the chance of a break-in.

“Traditional email security systems are going to be almost useless in stopping this,” he says, noting how most tools look at the API of the email provider. “Once an attacker is in, they don’t see internal emails … only the external emails coming in.”

DARKReading

Avoid These Corrupted Chrome Extensions (For Now)

/in ,

Chrome browser extensions are beautiful things. They can translate pages, help you manage your passwords and even get rid of unpleasant words. However, they’re also prime vectors for all kinds of unpleasant malicious code.

Usually, it’s easy enough to sort out genuine Chrome extensions from their shady brethren, but what happens when good plugins go bad? At least eight Chrome extension developers have fallen prey to phishing schemes, had their Chrome developer accounts hijacked and their extensions altered. Their once-legitimate Chrome extensions now threaten millions of people, and it’s likely more Chrome extension hijacks will come to light.

The French security researcher known only as “Kafeine” discovered six new compromised extensions, adding to two more discovered earlier this month, and shared his findings on the Proofpoint website Monday (Aug. 14). The six otherwise-helpful Chrome extensions are currently spamming users with malicious popups and redirected advertisements, and it’s likely that all eight developers fell for the same phishing scheme.

First things first: If you have one of the corrupted extensions, you should uninstall or disable it right away. (However, you should also bookmark the developer’s homepage, blog or Twitter account so that you know when it’s safe to reinstall.) It doesn’t matter if you’re using Windows, macOS or Linux, as Chrome extensions are generally platform-independent.

The version numbers for four of the compromised extensions are as follows:

  • Chrometana 1.1.3
  • Infinity New Tab 3.12.3
  • Web Paint 1.2.1
  • Social Fixer 20.1.1

Two more extensions appear to have been compromised at the end of June, but the exact version numbers of the corrupted code are unverified:

  • TouchVPN [current version 1.5.12, last updated June 25]
  • Betternet VPN [current 4.4.5, last updated July 6]

Bleeping Computer estimates that almost 5 million people may be at risk from these extensions.

Two additional apps, Copyfish and Web Developer, fell prey to the exact same method of hijacking earlier this month. However, those two apps have since been updated, and should be safe to use once again.

The corrupted Chrome extensions are not dangerous in and of themselves, but use them long enough, and they can almost certainly compromise your computer.

Rather than infecting systems themselves, the extensions redirect users to malicious websites that can do it for them. The compromised extensions spam users with popups, which exhort them to click on harmful sites. Furthermore, they replace legitimate advertisements with ones that have much more unscrupulous destinations.

As for how the extensions became corrupted in the first place, it’s a surprisingly simple story: The developers got phished. The men and women behind the Chrome extensions received extremely convincing emails from a Google lookalike, explaining that they had to log into their Google developer accounts immediately or risk losing valuable assets. The link and email address both looked convincing, and the message did not contain any spelling or grammatical errors.

Once the developers “logged in,” the attackers had their Google developer-account username and passwords. From there, the attackers changed the code of the developers’ extensions and pushed out updates.

The lesson here is not “don’t use Google Chrome Extensions,” since they’re generally helpful, reliable bits of software. Instead, perhaps, users may want to follow their favorite extension developers on Twitter to be notified of potential security breaches like this one ASAP. Keeping extensions up to date (which Chrome does automatically by default) and having a reliable antivirus program installed never hurt, either.

tom's guide

6 tips to protect your personal information when using public Wi-Fi

/in ,

As the Internet has become a crucial part of everyday life, so too has the need to access it virtually anytime, anywhere.

In fact, according to a recent survey completed by Symantec, over 66 per cent of Canadians consider access to public Wi-Fi when making travel or entertainment arrangements.

Based on these numbers – and the risk of using public networks – it’s important to know how to protect yourself. Here are six tips you can use to protect your personal information on public Wi-Fi networks, before and after you connect.

Before you log on

Keep on top of security updates

As the world learned from the WannaCry ransomware attack, which started by delaying a Windows update and went on to affect hundreds of thousands of computers, staying on top of software updates is the most prudent way to protect yourself against hackers and cybercriminals.

According to Forbes, “there’s no magic bullet to data security,” and diligently running updates for your operating system and web browser is one of the primary ways to protect yourself.

Turn off file-sharing and close shared folders on your laptop

While shared folders can be a great way to work collaboratively with colleagues, and share photos amongst family, make sure to close them and turn off file-sharing before logging onto a public network with your laptop or mobile device.

A blog post from the online security company Zone Alert states that once your computer connects to a public Wi-Fi service, those folders can be viewed by anyone else on the network. A public Wi-Fi field guide from Gizmodo concurs with this suggestion.

To avoid any information falling into the wrong hands, users should adjust their privacy settings to ensure they are different for public and private networks.

Enable 2-factor authentication on any accounts that contain personal information

Two-factor authentication is a good option for anyone desiring a second layer of security on their physical electronic devices, including their mobile device and laptop.

Enabling multiple layers of authentication on email, social networking and bank accounts can also act as an additional line of defence against cyber criminals lurking on public networks, reports The Next Web.

Use a VPN (virtual private network)

One of the most effective ways to protect your information while using public Wi-Fi is to use a Virtual Private Network (VPN). Simply download a VPN app on your phone or mobile device and log into your VPN before connecting to the Internet.

A VPN reroutes your traffic through a private, encrypted network. Kevin Haley, director of product management for security response at Symantec, explains exactly why a VPN is so useful.

“What you’re doing is, within a public network, creating a private network that’s just for you, if you will,” Haley says.

“The other way it’s referred to is a tunnel. It’s really just making sure that your communication is surrounded by protection as you talk between where you are and wherever, the website that you’re going to.”

According to PCMag, some of the best VPN services of 2017 include NordVPN and Private Internet Access for Android, or KeepSolid or NordVPN for iPhone.

After you log on

Avoid signing in to accounts that contain personal information, including social media and online banking

Assuming that you’ve taken precautions beforehand, the next step is to be cautious after logging onto a public network. One of the best ways to play it safe is to avoid logging into any accounts that contain personal information, such as social media, work email and especially, online banking.

Haley pointed out that even though a website itself might be reputable, personal information still isn’t secure as long as the network is insecure.

While email remains relatively low-risk, Stephen Neville, founder of the Centre for Advanced Security at the University of Victoria, noted in an email that any financial transactions should never be completed over a public network.

“If you use encrypted transmissions, wireless access points offer reasonable security for low-risk activities, e.g. email, and security, that is more or less on par with a wired connection. But the security is insufficient for any higher-risk things like e-banking,” Neville wrote.

Make sure the URL is encrypted

It’s also helpful for users to know how to identify whether a website has taken steps to protect their information. Users can do this by checking the beginning of a URL to see whether it begins with HTTP or HTTPS.

Haley explained that website URLs containing HTTPS use an SSL encryption to protect visitors to their site. Sites that use HTTPS will also show a small padlock next to the search bar.

“Users just need to look for the little lock that’s in the browser bar, and that tells you that your traffic is being encrypted,” said Haley.

globalnews