February 14, 2023
Good morning, everyone!
This week’s critical vulnerabilities:
Patch All the Things! |
Beware of event-related scams
It happens all the time, cyber criminals take advantage of some really big news item to (1) set up fake websites to collect (steal!) donations amd (2) embed malware in videos of the affected region. The recent earthquake in Turkey & Syria has prompted the same activity. The SANS Institute has some advice:
- Do not donate to organizations you have not heard of before the event. Only donate to organizations that have an established track record.
- If you have contacts in the affected area: Try to reach out to them to find out how to help them.
- Scams may target people with links to the affected region. Be careful with phone calls or emails claiming to ask for money on behalf of a relative or friend. Scammers may use social media data and may contact you via social media.
- Do not blindly believe requests for help on social media.
- Do not just Google for ways to donate money.
And, of course, always consult original sources of information!
How big is cyber crime?
According to the 2022 Cybersecurity Almanac, the "big business" of cyber crime is a $1.5T dollar industry:
"If it were measured as a country, then cybercrime — which was predicted to inflict damages totaling $6 trillion USD globally in 2021 — would be the world’s third-largest economy after the U.S. and China"
Massive spike in malvertising
Security researchers have reported a massive increase in malvertising in the past few days:
"Threat researchers are used to seeing a moderate flow of malvertising via Google Ads. However, over the past few days, researchers have witnessed a massive spike affecting numerous famous brands, with multiple malwares being utilized. This is not the 'norm'"
What is malvertising? It's a way of using legitimate advertising channels to propagate malicious software ("malware"). Sometimes it happens when the bad guys break into a server that distributes paid advertisements, but often the bad guys are just paying for ads like any other business. You gotta spend money to make money, right? And we know that cyber crime is big business!
The current run of malvertising is focused on impersonating big brands like Adobe Reader, Microsoft Teams, Mozilla Thunderbird, and Nvidia. (A couple weeks ago I wrote that malvertising campaigns were focusing on downloads of free software such as VLC, 7-Zip, CCleaner, Audacity, OBS, NotePad++ and more.)
How do you protect yourself?
(1) Check the URL of any website before clicking on a link. On a desktop computer, hover your mouse over the link. On a mobile device, press and hold the link. In both cases, the true destination of that link will show up in a popup, so you can see where that link will really take you. If the domain name doesn't look familiar, or anything looks suspicious, look for another way (an original source!) to get what you need.
(2) Download only from known, safe sites. If you routinely use a free software package, bookmark the developer's website so you can get updates with confidence. Sign up for his/her newsletter to get notified of updates and clean links to download.
(3) Consider using an ad blocker. I'm not a huge fan of ad blockers for work computers, because they do block legitimate functions pretty regularly, but for home computers, yes, definitely, using an ad blocker can protect against malicious downloads, especially when less-than-savvy users are surfing the web for fun.
Stay safe online this (and every) week!
Remember, you can read past editions of this newsletter on our website, along with tons more information under the Resources tab.
Have a great week!
Glenda R. Snodgrass
grs@theneteffect.com
(251) 433-0196 x107
https://www.theneteffect.com
For information security news & tips, follow me!
Security Awareness Training Available Here, There, Everywhere!
Thanks to COVID-19, lots of things went virtual, including my employee Security Awareness Training. Live training made a comeback a few months
ago, but many organizations are retreating. No worries. Wherever you and your employees may be, I can deliver an interesting and informative training session in whatever format you prefer.
Contact me to schedule your employee training sessions. They're fun! ☺