Microsoft Issues Emergency Windows Security Update For A Critical Vulnerability

/in ,
If your computer is running Microsoft’s Windows operating system, then you need to apply this emergency patch immediately. By immediately, I mean now!

Microsoft has just released an emergency security patch to address a critical remote code execution (RCE) vulnerability in its Malware Protection Engine (MPE) that could allow an attacker to take full control of a victim’s PC.

Enabled by default, Microsoft Malware Protection Engine offers the core cybersecurity capabilities, like scanning, detection, and cleaning, for the company’s antivirus and antimalware programs in all of its products.

According to Microsoft, the vulnerability affects a large number of Microsoft security products, including Windows Defender and Microsoft Security Essentials along with Endpoint Protection, Forefront Endpoint Protection, and Exchange Server 2013 and 2016, impacting Windows 7, Windows 8.1, Windows 10, Windows RT 8.1, and Windows Server.

Tracked as CVE-2017-11937, the vulnerability is a memory corruption issue which is triggered when the Malware Protection Engine scans a specially crafted file to check for any potential threat.

Flaw Lets Hackers Take Full Control of Your Computer

Successful exploitation of the flaw could allow a remote attacker to execute malicious code in the security context of the LocalSystem account and take control of the target’s computer.

Microsoft said an attacker could place a specially crafted malicious file in a location that is scanned by the Malware Protection Engine to exploit the memory corruption flaw which eventually leads to remote code execution.

“There are many ways that an attacker could place a specially crafted file in a location that is scanned by the Microsoft Malware Protection Engine. For example, an attacker could use a website to deliver a specially crafted file to the victim’s system that is scanned when the website is viewed by the user,” the report from Microsoft explained.

Other ways to deliver a specially crafted file could be via emails or Instant Messenger services. The attacker could also “take advantage of websites that accept or host user-provided content, to upload a specially crafted file to a shared location that is scanned by the Malware Protection Engine running on the hosting server,” the report said.

Patch! Patch! Patch!

Microsoft assured its customers that the vulnerability was fixed before any misuses in the wild.

The company has released an out-of-band critical update for the flaw and advised users to install it as soon as possible. Most home users and many enterprise customers will get the emergency patch automatically over the air.

The security vulnerability was discovered and reported to Microsoft by the UK’s National Cyber Security Centre (NCSC), a cyber defense organization of Britain’s signals intelligence and cybersecurity agency, known as GCHQ.

The emergency fix comes just days before Microsoft is scheduled to roll out its December Patch Tuesday updates.

The Hacker News

macOS High Sierra Bug Lets Anyone Gain Root Access Without a Password

/in , ,

If you own a Mac computer and run the latest version of Apple’s operating system, macOS High Sierra, then you need to be extra careful with your computer.

A serious, yet stupid vulnerability has been discovered in macOS High Sierra that allows untrusted users to quickly gain unfettered administrative (or root) control on your Mac without any password or security check, potentially leaving your data at risk.

Discovered by developer Lemi Orhan Ergin on Tuesday, the vulnerability only requires anyone with physical access to the target macOS machine to enter “root” into the username field, leave the password blank, and hit the Enter a few times—and Voila!

In simple words, the flaw allows an unauthorized user that gets physical access on a target computer to immediately gain the highest level of access to the computer, known as “root,” without actually typing any password.

Needless to say, this blindingly easy Mac exploit really scary stuff.

This vulnerability is similar to one Apple patched last month, which affected encrypted volumes using APFS wherein the password hint section was showing the actual password of the user in the plain text.

Here’s How to Login as Root User Without a Password

If you own a Mac and want to try this exploit, follow these steps from admin or guest account:

  • Open System Preferences on the machine.
  • Select Users & Groups.
  • Click the lock icon to make changes.
  • Enter “root” in the username field of a login window.
  • Move the cursor into the Password field and hit enter button there few times, leaving it blank.

With that (after a few tries in some cases) macOS High Sierra logs the unauthorized user in with root privileges, allowing the user to access your Mac as a “superuser” with permission to read and write to system files, including those in other macOS accounts as well.

This flaw can be exploited in several ways, depending on the setup of the targeted Mac. With full-disk encryption disabled, a rogue user can turn on a Mac that’s entirely powered down and log in as root by doing the same trick.

At Mac’s login screen, an untrusted user can also use the root trick to gain access to a Mac that has FileVault turned on to make unauthorized changes to the Mac System Preferences, like disabling FileVault.

All the untrusted user needs to do is click “Other” at the login screen, and then enter “root” again with no password.

However, it is impossible to exploit this vulnerability when a Mac machine is turned on, and the screen is protected with a password.

Ergin publicly contacted Apple Support to ask about the issue he discovered. Apple is reportedly working on a fix.

“We are working on a software update to address this issue. In the meantime, setting a root password prevents unauthorized access to your Mac. To enable the Root User and set a password, please follow the instructions here: https://support.apple.com/en-us/HT204012. If a Root User is already enabled, to ensure a blank password is not set, please follow the instructions from the ‘Change the root password’ section.”

Here’s How to Temporarily Fix the macOS High Sierra Bug

Fortunately, the developer suggested a temporary fix for this issue which is as easy as its exploit.

To fix the vulnerability, you need to enable the root user with a password. Heres how to do that:

  • Open System Preferences and Select Users & Groups
  • Click on the lock icon and Enter your administrator name and password there
  • Click on “Login Options” and select “Join” at the bottom of the screen
  • Select “Open Directory Utility”
  • Click on the lock icon to make changes and type your username and password there
  • Click “Edit” at the top of the menu bar
  • Select “Enable Root User” and set a password for the root user account

This password will prevent the account from being accessed with a blank password.

Just to be on the safer side, you can also disable Guest accounts on your Mac. for this, head on to System Preferences → Users & Groups, select Guest User after entering your admin password, and disable “Allow guests to log in to this computer.”

 

Microsoft Releases Update to Fix 53 Vulnerabilities

/in ,
Microsoft has released a large batch of security updates as part of its November Patch Tuesday in order to fix a total of 53 new security vulnerabilities in various Windows products, 19 of which rated as critical, 31 important and 3 moderate.

The vulnerabilities impact the Windows OS, Microsoft Office, Microsoft Edge, Internet Explorer, Microsoft Scripting Engine, .NET Core, and more.

At least four of these vulnerabilities that the tech giant has now fixed have public exploits, allowing attackers to exploit them easily. But fortunately, none of the four are being used in the wild, according to Gill Langston at security firm Qualys.

The four vulnerabilities with public exploits identified by Microsoft as CVE-2017-8700 (an information disclosure flaw in ASP.NET Core), CVE-2017-11827 (Microsoft browsers remote code execution), CVE-2017-11848 (Internet Explorer information disclosure) and CVE-2017-11883 (denial of service affecting ASP.NET Core).

Potentially Exploitable Security Vulnerabilities

What’s interesting about this month’s patch Tuesday is that none of the Windows OS patches are rated as Critical. However, Device Guard Security Feature Bypass Vulnerability (CVE-2017-11830) and Privilege Elevation flaw (CVE-2017-11847) are something you should focus on.

Also, according to an analysis of Patch Tuesday fixes by Zero-Day Initiative, CVE-2017-11830 and another flaw identified as CVE-2017-11877 can be exploited to spread malware.

“CVE-2017-11830 patches a Device Guard security feature bypass vulnerability that would allow malware authors to falsely authenticated files,” Zero-Day Initiative said.

“CVE-2017-11877 fixes an Excel security feature bypass vulnerability that fails to enforce macro settings, which are often used by malware developers.”

The tech giant also fixed six remote code execution vulnerabilities exist “in the way the scripting engine handles objects in memory in Microsoft browsers.”

Microsoft identified these vulnerabilities as CVE-2017-11836, CVE-2017-11837, CVE-2017-11838, CVE-2017-11839, CVE-2017-11871, and CVE-2017-11873, which could corrupt memory in such a way that attackers could execute malicious code in the context of the current user.

“In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft Edge and then convince a user to view the website,” Microsoft said. “These websites could contain specially crafted content that could exploit the vulnerability.”

17-Year-Old MS Office Flaw Lets Hackers Install Malware

Also, you should be extra careful when opening files in MS Office.

All versions of Microsoft Office released in the past 17 years found vulnerable to remote code execution flaw(CVE-2017-11882) that works against all versions of Windows operating system, including the latest Microsoft Windows 10 Creators Update.

However, due to improper memory operations, the component fails to properly handle objects in the memory, corrupting it in such a way that the attacker could execute malicious code in the context of the logged-in user.

Exploitation of this vulnerability requires opening a specially crafted malicious file with an affected version of Microsoft Office or Microsoft WordPad software, which could allow attackers to remotely install malware on targeted computers.

Adobe Patch Tuesday: Patches 62 Vulnerabilities

Besides fixing vulnerabilities in its various products, Microsoft has also released updates for Adobe Flash Player.

These updates correspond with Adobe Update APSB17-33, which patches 62 CVEs for Acrobat and Reader alone. So, Flash Player users are advised to ensure that they update Adobe across their environment to stay protected.

It should also be noted that last Patch Tuesday, Microsoft quietly released the patch for the dangerous KRACK vulnerability (CVE-2017-13080) in the WPA2 wireless protocol.

Therefore, users are also recommended to make sure that they have patched their systems with the last month’s security patches.

Alternatively, users are strongly advised to apply November security patches as soon as possible in order to keep hackers and cybercriminals away from taking control of their computers.

For installing security updates, just head on to Settings → Update & security → Windows Update → Check for updates, or you can install the updates manually.

The Hacker News

Built-in Keylogger Found in MantisTek GK2 Keyboards—Sends Data to China

/in ,
“The right keyboard can make all the difference between a victory and a defeat in a video game battlefield.”

If you are a gamer, you can relate to the above quote.

But what if your winning weapon betrays you?

The popular 104-key Mantistek GK2 Mechanical Gaming Keyboard that costs around €49.66 has allegedly been caught silently recording everything you type on your keyboard and sending them to a server maintained by the Alibaba Group.

This built-in keylogger in Mantistek GK2 Mechanical Gaming Keyboard was noticed by a few owners who headed on to an online forum to share this issue.

According to Tom’s Hardware, MantisTek keyboards utilise ‘Cloud Driver’ software, maybe for collecting analytic information, but has been caught sending sensitive information to servers tied to Alibaba.

After analysing more closely, Tom’s Hardware team found that Mantistek keyboard does not include a full-fledged keylogger. Instead, it captures how many times a key has been pressed and sending this data back to online servers.

The affected users also provided a screenshot showing how all your plain-text keystrokes collected by the keyboard are being uploaded to a Chinese server located at IP address: 47.90.52.88.

However, even if there’s no malicious intent, capturing and uploading keystroke counts without users’ consent violates trust and puts systems’ security at risk by leaking sensitive information.

Mantistek-GK2-Mechanical-Gaming-Keyboard-Keylogger

Since Alibaba Group also sells cloud services like Google and Amazon, this collected information is not necessarily being sent to the Alibaba itself, but someone who is using its cloud service.

Opening the IP address in question directly into a web browser and on a Chinese login page, which translates to “Cloud mouse platform background management system” and is maintained by Shenzhen Cytec Technology Co., Ltd.

Reportedly, the MantisTek keyboard’s software sends the collected data to two destinations at that IP address:

  • /cms/json/putkeyusedata.php
  • /cms/json/putuserevent.php

The best way to prevent your keyboard from sending your keystrokes to the Alibaba server is to stop using your Mantistek GK2 Mechanical Gaming Keyboard until you hear back from the company about this issue.

If you cannot prevent yourself from using the keyboard, but want to stop it from sending your key presses to the Alibaba server, just make sure the MantisTek Cloud Driver software is not running in the background, and block the CMS.exe executable in your firewall.

To block the CMS.exe executable, add a new firewall rule for the MantisTek Cloud Driver in the “Windows Defender Firewall With Advanced Security.”

The Hacker News

Watch out: These phishing emails claiming to be a ‘secure message’ from your bank

/in ,

Cyber criminals are faking secure messages from banks as a means of delivering malware to victims.

Often provided through an online portal, banks often provide secure messaging services for the purposes of communicating with the bank without having to pick up the phone or visit the a branch.

Hackers have realised that this provides a new method of attack and are now crafting spoof emails claiming to contain documentation relating to secure messages.

The sorts of clients who opt to use these secure messaging services are often high-value targets who already have a trusting online relationship with their bank – so could be more willing to follow instructions they get in an email from scammers that they believe to be real.

Criminals are registering domains that appear to look like legitimate bank domains and the fact they’re fake goes unnoticed because users don’t know how to spot an imposter or their email client doesn’t show the full domain in the subject line.

Uncovered by security researchers at Barracuda Networks, the campaign uses phishing emails to impersonate customers of big banks including Bank of America and TD Commercial banking.

The spoof messages are designed in such a way so as to look legitimate, even featuring sender addresses which look as if they come from the institution.

In some instances, the messages simply ask the victim to click on and download and attached document. However, others keep up the façade of being ‘secure’ – some emails provide instructions about using an authorization code to ‘unlock’ the attachment.

The malicious payload within is able to rewrite the files in the users’ directory on Windows machines once the victim opens the document – and this script can potentially missed by anti-virus software, thrown off the scent because they think the document is benign.

However, once downloaded onto the system, criminals have access to it and can update the script at a later date to become something more malicious, such as credential stealing malware – enabling them to stealthily gain access to the bank account of the victim – or something more brazen like ransomware.

Faking email messages might seem like a basic attack, but criminals are deploying this tactic because it works – especially when trusted institutions such as banks are used.

However, the good news is that users can be trained to spot phishing attacks – taking a step back and assessing the legitimacy of an email can go a long way towards protecting an individual or their organisation from falling victim to hackers.

zdnet

Malware discovered in CCleaner put millions of users at risk

/in

System-cleaning tool CCleaner is one of the most popular programs of its type in the world. According to Avast, which recently acquired maker Piriform, it boasts over 2 billion worldwide downloads and receives 5 million more each week. But it’s just been reported that up to 2.27 million users were put at risk from a backdoor found in a recent version of the program.

Security firm Cisco Talos warned that version 5.33 of CCleaner, which was downloadable from August 15 to September 11, had been modified to include the Floxif malware. The unaffected version 5.34 was released on September 12, but those who downloaded the tool during the weeks that version 5.33 was available may have unwittingly installed the backdoor.

The exact versions that were infected were the 32-bit version of CCleaner and CCleaner Cloud 1.07.3191. The 64-bit version of CCleaner was not affected.

Floxif can gather information about an infected system and send the data back to a hacker’s server. It can also allow other forms of malware, such as ransomware and keyloggers, to make their way onto a victim’s computer.

It’s unclear exactly how the person or persons responsible breached Avast’s systems, but Talos speculates it could have been “an insider with access to either the development or build environments within the organization.”

Paul Yung, Piriform’s Vice President of Products, has tried to play down the attack. In a blog post today, he wrote: “The threat has now been resolved in the sense that the rogue server is down, other potential servers are out of the control of the attacker.”

“Users of CCleaner Cloud version 1.07.3191 have received an automatic update. In other words, to the best of our knowledge, we were able to disarm the threat before it was able to do any harm.”

The company said it was working with US law enforcement agencies to discover who was behind the incident. “We apologize and are taking extra measures to ensure this does not happen again,” it added.

TechSpot

New Bluetooth vulnerability can hack a phone in 10 seconds

/in ,

More than 5.3 billion devices with Bluetooth signals are at risk of a malware attack newly identified by an internet of things security company.

If you’re not keeping count, that’s most of the estimated 8.2 billion devices that use Bluetooth, which allows for our gadgets to connect and communicate wirelessly. Nearly every connected device out there has Bluetooth capability. Your phones, laptops, speakers, car entertainment systems — the list goes on and on to even the most mundane gadgets.

Because those devices can connect to others effortlessly, Bluetooth has left an open attack point for hackers, according to researchers at Armis Labs. The attack method, which they’re calling BlueBorne, is especially dangerous because it can spread without the victim doing anything or noticing it.

In a lot of cases, malware depends on people clicking on a link they shouldn’t have, or downloading a virus in disguise. With BlueBorne, all hackers need to spread malware is for their victims’ devices to have Bluetooth turned on, said Nadir Izrael, Armis’ chief technology officer.

And once one device has been infected, the malware can spread to other devices nearby with the Bluetooth turned on. By scattering over the airwaves, BlueBorne is “highly infectious,” Armis Labs said.

“We’ve run through scenarios where you can walk into a bank and it basically starts spreading around everything,” Izrael said.

The attack echoes the way the WannaCry ransomware spread earlier this year. WannaCry allegedly used the NSA’s EternalBlue vulnerability and infected computers on the same network, even though they never downloaded the virus. That ransomware infected hundreds of thousands of computers within several hours.

Ben Seri, Armis Labs’ head of research, fears that BlueBorne will lead to a similar massive outbreak. In several trials testing out BlueBorne, researchers were able to create botnets and install ransomware using Bluetooth, all under the radar of most protection.

“Imagine there’s a WannaCry on Bluetooth, where attackers can deposit ransomware on the device, and tell it to find other devices on Bluetooth and spread it automatically,” said Michael Parker, the company’s vice president of marketing.

BlueBorne is a collection of eight zero-day vulnerabilities that Armis Labs discovered. Zero-day vulnerabilities are security flaws that are found before developers have a chance to fix them. That kind of exploit lets hackers execute malware remotely, steal data and pretend to be a safe network as a “man in the middle” attack.

It does this by taking advantage of how your Bluetooth uses tethering to share data, the company said. It’s able to spread through “improper validation,” Izrael said. The vulnerability affects devices on most operating systems, including those run by Google, Microsoft and Apple.

The three companies have released patches for the vulnerability. Apple confirmed that BlueBorne is not an issue for its mobile operating system, iOS 10, or later, but Armis noted that all iOS devices with 9.3.5 or older versions are vulnerable. Microsoft released a patch for its computers in July, and anybody who updated would be protected automatically, a spokesman said. Google said Android partners received the patch in early August, but it’s up to the carriers to release the updates. Pixel devices have already received the updates.

Of the 2 billion devices using Android, about 180 million are running on versions that will not be patched, according to Armis.

The concern is the multitude of devices that will not be getting updates. Google, Microsoft and Apple are tech titans that regularly update their products for security. But updates might not be as frequent for single-purpose smart devices like your smart refrigerator or a connected television.

Of the potentially impacted devices, Armis Labs estimated that 40 percent are not going to be patched. That’s more than 2 billion devices that will be left vulnerable to attacks, they warned.

“We’re looking at a forever-day scenario for many of these devices,” Parker said.

You can turn off your Bluetooth to prevent attacks if you won’t receive the patch, Armis advised.

cnet

711 Million Email Addresses Exposed: How to Protect Yourself

/in ,

Typically, your spam folder catches a lot of the malware-infected crud sent by the mischievous never-do-wells from the darker corners of the internet. Unfortunately, a newly discovered attack has targeted more than 711 million email accounts.

Fortunately, only some — not all — of the targets’ passwords have been taken.

The Onliner spambot, first discovered by a Paris-based security researcher who goes by the Benkow pseudonym, was confirmed by well-regarded security expert Troy Hunt in an August 30 blog post. Hunt — a Microsoft Regional Director who runs the breach-tracking website Have I Been Pwned — referred to a data dump from Onliner as “a mind-boggling amount of data,” in which he even found his own email address.

How does Onliner do it?

According to a ZDNet report, the hooligans behind the spambot compiled a massive database of 80 million email credentials from a number of other breaches, such as the LinkedIn hack. These logins were then used to spam 630 million email addresses, whose spam filters they jumped right over.

What can you do?

First, check Have I Been Pwned to see if your email account information is in the hack, Onliner may not have much of your information beyond your address. Onliner worked by sending two rounds of emails, as only a fraction of the 711 million targets could actually be infected by its malware.

If Have I Been Pwned says your email address appeared in the Onliner dump, there are three steps you need to take immediately. The first is changing the password to your email account. Second, make sure you’re not using that password in any other online accounts — especially those for banking. Lastly, enable two-factor authentication, so your email address and password alone aren’t enough for your account to be cracked.

The spambot campaign whittled its target list down by placing a difficult-to-see, pixel-sized image in its initial emails, which contained code to send a user’s IP address and system information back to HQ. If the pixel detected its recipient was a Windows PC (Androids, iOS devices and Macs are protected), it would tell the server to send more-targeted emails — which looked like invoices — to the addresses it identified as vulnerable.

Now’s a good time to look into a password manager, which can help you create strong, hard-to-guess passwords. And of course, do your best to avoid opening suspicious-looking emails, especially those that look like invoices for services you don’t pay for.

The secondary wave of emails is smaller for the sake of obscurity, since larger attacks are more likely to draw the attention of law enforcement and security experts. The infectious emails contain a JavaScript file that does all the dirty work, pwning your machine.

tom's guide

Avoid These Corrupted Chrome Extensions (For Now)

/in ,

Chrome browser extensions are beautiful things. They can translate pages, help you manage your passwords and even get rid of unpleasant words. However, they’re also prime vectors for all kinds of unpleasant malicious code.

Usually, it’s easy enough to sort out genuine Chrome extensions from their shady brethren, but what happens when good plugins go bad? At least eight Chrome extension developers have fallen prey to phishing schemes, had their Chrome developer accounts hijacked and their extensions altered. Their once-legitimate Chrome extensions now threaten millions of people, and it’s likely more Chrome extension hijacks will come to light.

The French security researcher known only as “Kafeine” discovered six new compromised extensions, adding to two more discovered earlier this month, and shared his findings on the Proofpoint website Monday (Aug. 14). The six otherwise-helpful Chrome extensions are currently spamming users with malicious popups and redirected advertisements, and it’s likely that all eight developers fell for the same phishing scheme.

First things first: If you have one of the corrupted extensions, you should uninstall or disable it right away. (However, you should also bookmark the developer’s homepage, blog or Twitter account so that you know when it’s safe to reinstall.) It doesn’t matter if you’re using Windows, macOS or Linux, as Chrome extensions are generally platform-independent.

The version numbers for four of the compromised extensions are as follows:

  • Chrometana 1.1.3
  • Infinity New Tab 3.12.3
  • Web Paint 1.2.1
  • Social Fixer 20.1.1

Two more extensions appear to have been compromised at the end of June, but the exact version numbers of the corrupted code are unverified:

  • TouchVPN [current version 1.5.12, last updated June 25]
  • Betternet VPN [current 4.4.5, last updated July 6]

Bleeping Computer estimates that almost 5 million people may be at risk from these extensions.

Two additional apps, Copyfish and Web Developer, fell prey to the exact same method of hijacking earlier this month. However, those two apps have since been updated, and should be safe to use once again.

The corrupted Chrome extensions are not dangerous in and of themselves, but use them long enough, and they can almost certainly compromise your computer.

Rather than infecting systems themselves, the extensions redirect users to malicious websites that can do it for them. The compromised extensions spam users with popups, which exhort them to click on harmful sites. Furthermore, they replace legitimate advertisements with ones that have much more unscrupulous destinations.

As for how the extensions became corrupted in the first place, it’s a surprisingly simple story: The developers got phished. The men and women behind the Chrome extensions received extremely convincing emails from a Google lookalike, explaining that they had to log into their Google developer accounts immediately or risk losing valuable assets. The link and email address both looked convincing, and the message did not contain any spelling or grammatical errors.

Once the developers “logged in,” the attackers had their Google developer-account username and passwords. From there, the attackers changed the code of the developers’ extensions and pushed out updates.

The lesson here is not “don’t use Google Chrome Extensions,” since they’re generally helpful, reliable bits of software. Instead, perhaps, users may want to follow their favorite extension developers on Twitter to be notified of potential security breaches like this one ASAP. Keeping extensions up to date (which Chrome does automatically by default) and having a reliable antivirus program installed never hurt, either.

tom's guide

6 tips to protect your personal information when using public Wi-Fi

/in ,

As the Internet has become a crucial part of everyday life, so too has the need to access it virtually anytime, anywhere.

In fact, according to a recent survey completed by Symantec, over 66 per cent of Canadians consider access to public Wi-Fi when making travel or entertainment arrangements.

Based on these numbers – and the risk of using public networks – it’s important to know how to protect yourself. Here are six tips you can use to protect your personal information on public Wi-Fi networks, before and after you connect.

Before you log on

Keep on top of security updates

As the world learned from the WannaCry ransomware attack, which started by delaying a Windows update and went on to affect hundreds of thousands of computers, staying on top of software updates is the most prudent way to protect yourself against hackers and cybercriminals.

According to Forbes, “there’s no magic bullet to data security,” and diligently running updates for your operating system and web browser is one of the primary ways to protect yourself.

Turn off file-sharing and close shared folders on your laptop

While shared folders can be a great way to work collaboratively with colleagues, and share photos amongst family, make sure to close them and turn off file-sharing before logging onto a public network with your laptop or mobile device.

A blog post from the online security company Zone Alert states that once your computer connects to a public Wi-Fi service, those folders can be viewed by anyone else on the network. A public Wi-Fi field guide from Gizmodo concurs with this suggestion.

To avoid any information falling into the wrong hands, users should adjust their privacy settings to ensure they are different for public and private networks.

Enable 2-factor authentication on any accounts that contain personal information

Two-factor authentication is a good option for anyone desiring a second layer of security on their physical electronic devices, including their mobile device and laptop.

Enabling multiple layers of authentication on email, social networking and bank accounts can also act as an additional line of defence against cyber criminals lurking on public networks, reports The Next Web.

Use a VPN (virtual private network)

One of the most effective ways to protect your information while using public Wi-Fi is to use a Virtual Private Network (VPN). Simply download a VPN app on your phone or mobile device and log into your VPN before connecting to the Internet.

A VPN reroutes your traffic through a private, encrypted network. Kevin Haley, director of product management for security response at Symantec, explains exactly why a VPN is so useful.

“What you’re doing is, within a public network, creating a private network that’s just for you, if you will,” Haley says.

“The other way it’s referred to is a tunnel. It’s really just making sure that your communication is surrounded by protection as you talk between where you are and wherever, the website that you’re going to.”

According to PCMag, some of the best VPN services of 2017 include NordVPN and Private Internet Access for Android, or KeepSolid or NordVPN for iPhone.

After you log on

Avoid signing in to accounts that contain personal information, including social media and online banking

Assuming that you’ve taken precautions beforehand, the next step is to be cautious after logging onto a public network. One of the best ways to play it safe is to avoid logging into any accounts that contain personal information, such as social media, work email and especially, online banking.

Haley pointed out that even though a website itself might be reputable, personal information still isn’t secure as long as the network is insecure.

While email remains relatively low-risk, Stephen Neville, founder of the Centre for Advanced Security at the University of Victoria, noted in an email that any financial transactions should never be completed over a public network.

“If you use encrypted transmissions, wireless access points offer reasonable security for low-risk activities, e.g. email, and security, that is more or less on par with a wired connection. But the security is insufficient for any higher-risk things like e-banking,” Neville wrote.

Make sure the URL is encrypted

It’s also helpful for users to know how to identify whether a website has taken steps to protect their information. Users can do this by checking the beginning of a URL to see whether it begins with HTTP or HTTPS.

Haley explained that website URLs containing HTTPS use an SSL encryption to protect visitors to their site. Sites that use HTTPS will also show a small padlock next to the search bar.

“Users just need to look for the little lock that’s in the browser bar, and that tells you that your traffic is being encrypted,” said Haley.

globalnews