Old MAC

  With the release if the M1 Apple chip MACs you may have or plan to upgrade your MAC hardware. You have value in your old ro replaced hardware. 

 Before you do gift, recycle, or abandon your older hardware be aware the security of MacOS from Mojave on may prevent use by anyone else. This is the helpful <-> harmful aspect of most cyber security. If your MAC is stolen or misplaced you do NOT want others to access the data stored on that MAC. But you do want to put the hardware to use in an environmental responsible way.

 Step one. Sign out on the old hardware. Sign out of iMessage, iTunes, iCloud, and amy applications where you authenticate with your Apple ID.

BE SURE you are ready, really ready to proceed. After these next steps you will be able to recover. After these next steps others will not.

 Consider unpairing any Bluetooth devices.

To erase and re-install MacOS:

Shutdown and boot the MAC while holding down the Command + R keys                            Select the Disk Utility 

Select the system disk 

Click Erase 

Provide a name for the disk    consider APFS for the format

Erase any other internal disks and any Volume Groups 

Disable Find My if that ability was enabled 

After the format is complete quit the Disk Utility and select Reinstall MacOS from the utilities window.

After the re-install completes:

Next clear parameters you have set that are stored in the MAC hardware. These settings can be used to recover MACs for forensics. 

 Shutdown the MAC   Power on with the Option + Command + P + R                                      Not easily done  On purpose I would imagine                                                                            You will know if this step erased the settings in NVRAM and parameter RAM if your parameters are no longer available.

 Your MAC should boot into a fresh install of MacOS

Adrozek

  A cross browser campaign is currently on the Internet.

Affects all browsers, probably on all platforms.

As more and more is on our networks, there will be more and threats to steal or copy credentials for financial gain for the bad gals/guys and financial ruin for us.

 This one has been named Adrozek by researchers at Microsoft. 

 Is has been found to perform unwanted ad injection for search results. It is capable of much more. Credential stealing or copying as an example. If you have stored credentials in a browser for a digital wallet for digital currency, a financial institution, on-line shopping, etc. you might consider changing the passphrases/passwords and store the credentials in a more secure location. Password managers, password hints in a safe, etc.

 Monitor, monitor, monitor. Recognize all of the browser helper objects, browser extensions, browser add-ons in all of your browsers? Use separate and secured browser instances for financial access?
Keep your software, applications, firmware, alerts, security suite signatures, and other defenses up to date?

 Once discovered Adrozek was infecting 30,000 devices a day.

 Adrozek disables browser updates, establishes a windows service, and other harmful actions. Once a malware tool is released other actors can modify the actions to perform greater harm. 

 Microsoft Defender (formally known as Windows Defender) has had signatures to detect and attempt a clean of infected Windows PCs. Other browser platforms (MacOS, Linus, BSD, etc.) are vulnerable as well.

 To protect your platforms use standard and proven cyber defenses and hygiene.

 A suggestion for Windows: use Windows Update to obtain the most current Defender signature updates. Then perform a full scan of all volumes.

 Then Windows Security -> Virus and threat protection -> Full scan

 Be aware a full scan can take a loooong time on a disk with a lot of files.

Safer Holiday Shopping

 Use Digital wallets

 Apple Pay, Google Pay, etc. Merchants do not see your credit card info. Similar to PayPal without giving your information to PayPal. The technology uses a secure digital token based on cryptography.

Then protect those digital wallets, have a tested backup and recovery plan. Monitor those wallets.

Avoid public Wi-Fi

It is trivial to setup a Wi-Fi hotspot with known merchant or store network names. Once connected to these rogue Wi-Fi networks any and all data provided via Wi-Fi is at risk

Similarly, consider turning OFF your device Wi-Fi while away from your home networks. The network name your device "beacons" can be detected and spoofed.

Use VPN

Virtual Private Networks provide an encrypted tunnel from and to end points. This protects data in transit across the Internet. Choose your VPN provider with care, there are VPNs that steal data and sell your connection history.

A drawback to VPNs, your source IP address may rapidly change. Good for avoiding tracking. Not so good when your bank notices your device changing location.

Avoid storing Credit card info at sites

Convenient - true. Dangerous - also true. Breaches and ransomware are a danger to that information.

Be aware at points of sale

Near Filed Communication (NFC) on debit and credit cards uses radio. Radio. Try to avoid others near you at point of sale terminals. Consider a RFID shields for wallets and purses.

Consider turning credit cards Off

Most banks can and will disable your credit and debit cards, then enable when YOU re-enable them.

Review and Use banking alerts

Use the alert features on all your financial institutions. Once setup, take the time to check the alerts are sent to you, not an identity thief.

Employ virtual credit cards

Some banks, credit unions, etc. provide a one-time card number for on-line use

Prefer Credit over Debit

Credit cards transfer the bank's money to merchants. Debit cards transfer your money to merchants.

PayPal

Hides, to a degree, your credit & financial information. NOT FDIC insured, has fees, subject to insider theft.

Increase financial monitoring

Monitor your finances. Brokers, company IRAs, merchant accounts, ...

Report Identity theft

No matter how small. As each of are safer, we are all safer. The quicker the detection and reporting, the quicker your identity can be restored

Report suspicious activity

FTC site: 

Police:

Credit Reporting Agencies

Your bank

Again, the quicker the better

Beware social media Ads

Tis the season. The pandemic has affected cyber criminals. Bad recommendations, false claims, etc. Stolen social media accounts of friends are used as well. 

Avoid Phishing lures

 A expected and real increase at this time of year. These campaigns appear more real than real.

Be suspicious, be informed, be prepared.

Be very suspicious of unsolicited phone calls & messages

Thieves are using Artificial Intelligence to greatly increase the "pitch". Be wary of any urgency, threats, and other techniques. "To avoid this charge please call back at this number" 

Use your detective skills to investigate.