We have been warned that fraudsters spoof CallerID so you are more prone to answer. Then they use the CallerID of local law enforcement, neighbors, your bank.
Your bank. We have been warned to call the bank back if there is any doubt as to the authenticity of the call and not be so easily fooled by a spoofed CallerID.
Now reports of the spoof going the other way. Fraudsters spoof YOUR CallerID and call your bank. If the CallerID matches the bank's records and the "normal" methods of verifying your IDentity pass, the bank will comply with the requests and you will not be happy.
Social media, big data, and prior phone calls to you might provide enough information to successfully pass the bank's fraud detection scripts and methods.
In our experience the bank may ask to verify or provide the last few transactions on the account. Often the bank's list has a few transactions you did not make - part of the procedure, you will not recognize or acknowledge these false transactions by design.
Now fraudsters are successfully circumventing this method.
How?
They spoof your CallerID and use the automated systems to learn your last few transactions.
I would think this would be a very targeted attack, but wanted to raise awareness.
Awareness, preparedness, understanding.
Thursday, April 30, 2020
Wednesday, April 29, 2020
Got iPhone Got lock-ups, freezes, shutdowns?
Have iPhone lockups, freezes, etc. lately? By sending eMail, Messages, and some other apps with Notification enabled a receiving iPhone, perhaps iDevices like iPads, can lockup.
The message, eMail, or other app just needs to send a crafted message with a special character set to cause the lockup. That crafted message has made it onto many forums so the lockups are becoming more and more common.
Apple is aware and says it has the fix. Until the fix is available you might consider disabling Notifications for some apps and features like Messenger, eMail, etc.
It's not the app, its the Notification.
Settings -> Notifications then Notifications Off for Messages, etc.
Then re-enable Notifications once the problem is fixed.
Update: With out Notification Messages, eMails, and other Apps will need to be explicitly checked. The lockups, freezes, etc. are usually a nuisance.Balance that with having no notification. A power cycle, wait for automatic reboot, etc.
The message, eMail, or other app just needs to send a crafted message with a special character set to cause the lockup. That crafted message has made it onto many forums so the lockups are becoming more and more common.
Apple is aware and says it has the fix. Until the fix is available you might consider disabling Notifications for some apps and features like Messenger, eMail, etc.
It's not the app, its the Notification.
Settings -> Notifications then Notifications Off for Messages, etc.
Then re-enable Notifications once the problem is fixed.
Update: With out Notification Messages, eMails, and other Apps will need to be explicitly checked. The lockups, freezes, etc. are usually a nuisance.Balance that with having no notification. A power cycle, wait for automatic reboot, etc.
Saturday, April 25, 2020
COVID-19 Cyber Safety
Safer NOT Safe
Major cyber security outlets cite 30,000% increase in Covid-19 scams, attacks, IDentity thefts, security breaches, and other criminal activity. The lock down has affected the criminal element, they are fighting back.
Most of the financial damage to our cyber wealth has been using scams to which no amount of security hardening of our Internet connected devices would prevent.
Is your credit card number for sale on the Dark Web? Enter it here to find out. If it wasn't before, it will be now.
All of the major browsers have had security updates recently. Most of the browser add-ons, banking applications, VPNs, zoom, etc. have several security updates. Microsoft, Apple, Linux same efforts.
Microsoft released KB4550945 out of band April 22. Very rare, Very important. As last Tuesday is non on a B schedule, you will need to use Windows Update to request it.
Zoom has important updates to date and should update to release 5 very soon.
We are feeling financial pain. The criminal element is feeling their financial pain. Take effort to not let their pain cause your pain.
Major cyber security outlets cite 30,000% increase in Covid-19 scams, attacks, IDentity thefts, security breaches, and other criminal activity. The lock down has affected the criminal element, they are fighting back.
Most of the financial damage to our cyber wealth has been using scams to which no amount of security hardening of our Internet connected devices would prevent.
Is your credit card number for sale on the Dark Web? Enter it here to find out. If it wasn't before, it will be now.
All of the major browsers have had security updates recently. Most of the browser add-ons, banking applications, VPNs, zoom, etc. have several security updates. Microsoft, Apple, Linux same efforts.
Microsoft released KB4550945 out of band April 22. Very rare, Very important. As last Tuesday is non on a B schedule, you will need to use Windows Update to request it.
Zoom has important updates to date and should update to release 5 very soon.
We are feeling financial pain. The criminal element is feeling their financial pain. Take effort to not let their pain cause your pain.
Saturday, April 18, 2020
Friday, April 17, 2020
Linksys and D-Link routers and or Wireless Access Points
All users of Linksys Smart Wi-Fi accounts had their passwords at that site reset 2-Apr-2020. Linksys found a large amount of traffic using a suspected credential stuffing attack to access that account's network. If successful the attackers changed the device's DNS settings to steer users to sites hosting COVID-19 related malware. The malware attempted to steal user's credentials for banking, financial, digital wallets, and others.
If you have used Linksys Smart Wi-Fi web site to manage or monitor your Linksys or D-Link devices you should reset your account's password and check your device's DNS settings.
It is good practice to have each device on your network use the local DNS settings on each network the device can connect to instead of the perimeter network devices like routers, cable modems, or Wireless Access Points.
If you have used Linksys Smart Wi-Fi web site to manage or monitor your Linksys or D-Link devices you should reset your account's password and check your device's DNS settings.
It is good practice to have each device on your network use the local DNS settings on each network the device can connect to instead of the perimeter network devices like routers, cable modems, or Wireless Access Points.
Secret Consumer Score
I recall getting a report card in school. Grades for the classes. Then a Deportment score.
The classes reports were understood and had a known range or score. A-F or 0-100 or similar. Deportment was free form and could be misunderstood. And verbose.
Same now in the cyber world. We are aware of credit scores. Easily understood, though not always agreed.
We might have a deportment score as well. I have yet to find a common name for this score or rating. Quite a few companies track and supply their customers with your consumer scores. The companies I have seen in reports:
Sift
Zeta Global
Retail Equation
Kustomer
Riskified
Consumer advocates who report on such matters tell interesting tales of the report contents. A reporter for the New York Times got a 400 page report on their activity that produced a customer score. The report included most of their messages to Airbnb, Yelp, etc. The report also included the date, time, device information, IP address, and more.
Clients of these services use the information and consumer score to assess your trustworthiness. How long you have waited on hold, do you return items often, order take out late evenings, etc.
For a period of time the companies might provide your report if you were under the GDPR protections. Now the response to a request for your data might be denied. The recent California Consumer Privacy Act has given some flux to the response requirements of these companies.
The customers of these companies (You are the product, not a customer) use the reports and scores to help prevent fraud, flag big spenders, and perhaps give you the VIP treatment.
A shock to the reports is how far back the data is kept. A shock is how arbitrary the scoring might be.
I have requested my data. I will update this post if I obtain any.
The classes reports were understood and had a known range or score. A-F or 0-100 or similar. Deportment was free form and could be misunderstood. And verbose.
Same now in the cyber world. We are aware of credit scores. Easily understood, though not always agreed.
We might have a deportment score as well. I have yet to find a common name for this score or rating. Quite a few companies track and supply their customers with your consumer scores. The companies I have seen in reports:
Sift
Zeta Global
Retail Equation
Kustomer
Riskified
Consumer advocates who report on such matters tell interesting tales of the report contents. A reporter for the New York Times got a 400 page report on their activity that produced a customer score. The report included most of their messages to Airbnb, Yelp, etc. The report also included the date, time, device information, IP address, and more.
Clients of these services use the information and consumer score to assess your trustworthiness. How long you have waited on hold, do you return items often, order take out late evenings, etc.
For a period of time the companies might provide your report if you were under the GDPR protections. Now the response to a request for your data might be denied. The recent California Consumer Privacy Act has given some flux to the response requirements of these companies.
The customers of these companies (You are the product, not a customer) use the reports and scores to help prevent fraud, flag big spenders, and perhaps give you the VIP treatment.
A shock to the reports is how far back the data is kept. A shock is how arbitrary the scoring might be.
I have requested my data. I will update this post if I obtain any.
Subscribe to:
Posts (Atom)