Tag Archives: details compromised

1.2 billions usernames and passwords stolen

Passwords Stolen

Passwords Stolen
Image courtesy of chanpipat / FreeDigitalPhotos.net

Huge amount of usernames and passwords stolen

500 millions email addresses have been compromised, representing 1.2 billions usernames and passwords stolen by a Russian gang. The breach was discovered by Hold Security .The company did not reveal who exactly is affected, as it usually is the custom in the industry. Big players are involved, and you need to pay Hold security in order for them to recoup the costs, if you want to know if your company is affected.

How can you protect yourself?

One way to stay protected, is to use a password manager to create complex passwords. This allows to use different password for different sites and services. If one set of credential gets compromised, this does not affect the other services.  This is however not of much value if your PC has been compromised, or if the email servers themselves have been compromised.

It looks like so far, the hacked email addresses are only being used for sending spam.

Sources

 NY times

 BBC

Hold Security

Hold Security

Wall Street journal

 

 

 

 

 

 

 

 

 

Cold Calling Scam

The PC Doctor Scam:

There has recently be an increase in the now classic scam by which so-called technicians are targeting New Zealanders with phone calls informing them that their computer had been infected. The scale of the problem has become such that Microsoft New Zealand and NetSafe have issued an alert this week (Fraud Awareness Week).

– The caller, often from overseas, states they are from Microsoft
– indicates that

  • your computer is infected and harming others on-line users
  • their ISP has identified their system as a problem.

– Con the computer owner to give the caller remote access using a genuine networking service.
– Use the ‘Event Viewer’ tool on the computer to highlight error messages which are supposedly signs of an infection.
–  Offer to clean up the infection and/or install security software and provide an ongoing support service costing anywhere up to $500.

That software, looking like a security software could also be collecting your credentials for identity theft and financial fraud. The credit card number supplied can be used to purchase goods using your account. The remote technician could install ransomware on your device, which means that he or she could encrypt your data, and demand a payment to give you access back to them.

What you can do:

Several possibilities:

  • ignore the call: hang-up
  • if you fell for it, and gave access to your computer, disconnect the machine from the internet immediately then consult a genuine local PC technician to check that nothing serious has been installed on your PC or laptop
  • report the call to NetSafe.
  • If you have paid money, discuss your options with your bank.

This article has been inspired by this post on Geekzone.

Major Operation Against Cybercrime in the UK

Alleged Cybercriminals arrested

The National CyberCrime Unit at NCA has recently launched a major operation against Cybercriminals in the UK.  The operation lasted one week, and seventeen people were arrested. These people are suspected of using software designed to steal data from other people’s computer. This is part of a worldwide operation that has taken place worldwide against the set of malware tools named Blackshades.
The most used tool in the suite is called Remote Access Tool, and allows the crooks to take a computer over remotely. Other capabilities of Blackshades include being able to control the video camera, microphone, and to record the keys being pressed on the keyboard, allowing for example to record an internet banking session, password included. It is estimated that more than 200,00 password have been stolen via Blackshades worldwide.

How are PCs infected?

Users get their PCs infected by following a link that can be located for example in a spam email, a twitter post or a Facebook post. The installation is invisible to the user.

How can you protect yourself?

Do not follow links in an email if you do not know the sender. Do not trust your Facebook friends when then publish a link: either their account might have been hacked, or if they might have shared with you a link that  has already infected their machine.

 

Another Chrome Security Concern

The Password Security Concern.

We already knew that storing any passwords on Google Chrome was dangerous , and the method to do this is widely available, as for example on this video.

The Microphone Concern.

It has now come to light that people can eavesdrop on you by accessing your microphone, without you being aware of it. It is not a simple process, but Guya.net describes it very well . Chrome is using outdated technology, which can be abused to have a web site accessing your microphone without any warning.

© Nguyen Thai | Dreamstime Stock Photos

Computer bugs
© Nguyen Thai | Dreamstime Stock Photos

The bug has been reported to Google, and let’s hope that a fix come soon. Or may be you might want to swap to another browser.

What browser are you using, and why?

Browser Passwords

Passwords Storage

Are you saving passwords for your favourite web sites in your browser? If yes, think twice. If you are using Chrome, this is not a secure at all. Have a look at this article published recently. I am not a frequent user of Internet Explorer or Safari,  and am not aware of their password storage strategy used.

How to secure passwords?

The issue is that you have to remember many usernames and passwords for various internet sites.

Solution 1: Use one or two usernames and passwords for everything.

And what happen if one of your password is compromised? The “hackers” will run software that will automatically try those on a great number of sites. This was the issue that prompted Telecom NZ to ask their users to change all their passwords, without really explaining the reason behind it. All what we knew was some accounts were accessed without the knowledge of the users, and were sending spam with links towards websites.

Solution 2 : Stick with saving Credentials within the browser.

The physical security of the equipment is not a problem, and no-one will ever be able to get physically to your PC. However, old fashion desktop PCs also get stolen. Do you really know what happen to your PC when your dispose of it? It is also a bad idea to use this strategy on mobile devices, as they tend to frequently be lost, forgotten or stolen.

Solution 3: Use a Safer Browser

Firefox is safer in that area, at it allows you to protect your database of username and passwords. with a master password. However, do not use a 3 letter password, as it could easily be cracked. It is better to aim for 8 or more letters

Solution 4 : Use a Password Management Software

What is a password management software? It is usually a small application that run on your computer, tablet or phone that enable you to:

  • create complex password
  • register them, associating them with the web site URL and a username
  • sometimes it links with your browser to save you typing anything.

The application create a small file that is either open with a password, a key file or a combination of the two. You can store the file or files on a hard drive or a USB stick. An other possibility is to store them on a network or  cloud drive to be able to get access to it from everywhere with multiple devices.

You can afford in that situation to create and memorize a long password, as it is the only one you will have to remember. But don’t go away on holiday and forget it!  There will be no way to recover the content of your file.  An other bad idea would be to write the password on a Postit note somewhere (by the monitor for example). I have seen people writing their master password on a piece of paper, they sticking it underneath the keyboard.

If you are using a key file, do not forget to back it up somewhere. it is also highly recommended to make a copy of you encrypted database file somewhere. Files can get corrupted. Drives can die, and they tend to do this at the most inconvenient time.

Two recommended password management software can be found on http://keepass.info/ and https://lastpass.com/

Keepass

Keepass image from http://keepass.info/

Are you using of any password management software? Is there anything else you would recommend?

Why using lastpass?

 

ACC Personal Details Compromised : Who’s fault is it?

We have learned this week that ACC clients had their personal details compromised after the theft of a laptop. You can find the summary of the incident here.

The laptop was used by a case manager who took the laptop home, in contradiction to the rules set by the organisation.

Several questions remain unanswered :

1.Why was the laptop hard drive not encrypted, if used out of the organisation?

2.Why did the case manager felt she had to records the personal detail of claimants on the laptop? If the details are needed in the day-to-day business, having a secure connection to the work network seems to be more logical.

3. Why did the case managed take the laptop home? Ignorance of the rules? Not enough time to complete the work during normal hour?

The press and ACC seem to blame the case manager, but unless she deliberately ignored the rules, this incident looks like a failure of the institution to secure its IT equipment properly.

I hope that we will learn more details about this case in the near future.

Have you got any more information about the case?